diff --git a/README.md b/README.md
index 232fe8c..77308e2 100644
--- a/README.md
+++ b/README.md
@@ -190,7 +190,7 @@ Both deployment modes support scanning multiple AWS regions in parallel via the
 
 Scanning uses a Step Functions Map state, so multiple regions execute in parallel with no additional time cost. Services unavailable in a region produce an informational N/A finding.
 
-The HTML report includes a Region column, filter dropdown, and "Risk by Region" summary.
+The HTML report includes a Region column, filter dropdown, and "Risk by Region / Scope" summary.
 
 > **Upgrading an existing deployment?** See [Troubleshooting](docs/TROUBLESHOOTING.md#9-upgrading-an-existing-deployment-to-multi-region) — it's a simple stack parameter update with no teardown.
 
diff --git a/aiml-security-assessment/functions/security/agentcore_assessments/app.py b/aiml-security-assessment/functions/security/agentcore_assessments/app.py
index 71a16da..eb0be10 100644
--- a/aiml-security-assessment/functions/security/agentcore_assessments/app.py
+++ b/aiml-security-assessment/functions/security/agentcore_assessments/app.py
@@ -51,6 +51,35 @@
     "https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/"
     "agentic-ai-lens.html"
 )
+AGENTCORE_STARTER_TOOLKIT_URL = (
+    "https://aws.github.io/bedrock-agentcore-starter-toolkit/"
+)
+AGENTCORE_VPC_REFERENCE_URL = (
+    "https://aws.github.io/bedrock-agentcore-starter-toolkit/"
+    "user-guide/security/agentcore-vpc.html"
+)
+AGENTCORE_OBSERVABILITY_REFERENCE_URL = (
+    "https://aws.github.io/bedrock-agentcore-starter-toolkit/"
+    "user-guide/observability/quickstart.html"
+)
+AGENTCORE_BROWSER_REFERENCE_URL = (
+    "https://aws.github.io/bedrock-agentcore-starter-toolkit/"
+    "user-guide/builtin-tools/quickstart-browser.html"
+)
+AGENTCORE_MEMORY_REFERENCE_URL = (
+    "https://aws.github.io/bedrock-agentcore-starter-toolkit/"
+    "user-guide/memory/quickstart.html"
+)
+AGENTCORE_GATEWAY_REFERENCE_URL = (
+    "https://aws.github.io/bedrock-agentcore-starter-toolkit/"
+    "user-guide/gateway/quickstart.html"
+)
+AGENTCORE_DATA_ENCRYPTION_REFERENCE_URL = (
+    "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html"
+)
+ECR_ENCRYPTION_REFERENCE_URL = (
+    "https://docs.aws.amazon.com/AmazonECR/latest/userguide/encryption-at-rest.html"
+)
 AGENTCORE_GATEWAY_API_REFERENCE_URL = (
     "https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/"
     "API_GetGateway.html"
@@ -464,7 +493,7 @@ def check_agentcore_vpc_configuration() -> List[Dict[str, Any]]:
                 finding_name="AgentCore VPC Configuration Check",
                 finding_details="AgentCore client not available in this region",
                 resolution="Deploy in a region where Amazon Bedrock AgentCore is available",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/",
+                reference=AGENTCORE_STARTER_TOOLKIT_URL,
                 severity=SeverityEnum.INFORMATIONAL,
                 status=StatusEnum.NA,
             )
@@ -504,7 +533,7 @@ def check_agentcore_vpc_configuration() -> List[Dict[str, Any]]:
                                     finding_name="AgentCore Runtime VPC Configuration",
                                     finding_details=f"Runtime '{runtime_name}' ({runtime_id}) is not configured with VPC. This exposes the runtime to public internet.",
                                     resolution="Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)",
-                                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md",
+                                    reference=AGENTCORE_VPC_REFERENCE_URL,
                                     severity=SeverityEnum.HIGH,
                                     status=StatusEnum.FAILED,
                                 )
@@ -543,7 +572,7 @@ def check_agentcore_vpc_configuration() -> List[Dict[str, Any]]:
                                                             finding_name="AgentCore Runtime Public Subnet",
                                                             finding_details=f"Runtime '{runtime_name}' is in public subnet {subnet_id} with direct internet access",
                                                             resolution="Move runtime to private subnets without direct internet gateway routes",
-                                                            reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md",
+                                                            reference=AGENTCORE_VPC_REFERENCE_URL,
                                                             severity=SeverityEnum.MEDIUM,
                                                             status=StatusEnum.FAILED,
                                                         )
@@ -580,7 +609,7 @@ def check_agentcore_vpc_configuration() -> List[Dict[str, Any]]:
                         finding_name="AgentCore VPC Configuration Check",
                         finding_details="All AgentCore resources have proper VPC configuration",
                         resolution="No action required",
-                        reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md",
+                        reference=AGENTCORE_VPC_REFERENCE_URL,
                         severity=SeverityEnum.HIGH,
                         status=StatusEnum.PASSED,
                     )
@@ -592,7 +621,7 @@ def check_agentcore_vpc_configuration() -> List[Dict[str, Any]]:
                         finding_name="AgentCore VPC Configuration Check",
                         finding_details="No AgentCore resources found",
                         resolution="No action required",
-                        reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md",
+                        reference=AGENTCORE_VPC_REFERENCE_URL,
                         severity=SeverityEnum.INFORMATIONAL,
                         status=StatusEnum.NA,
                     )
@@ -606,7 +635,7 @@ def check_agentcore_vpc_configuration() -> List[Dict[str, Any]]:
                 finding_name="AgentCore VPC Configuration Check",
                 finding_details=f"Error during check: {str(e)}",
                 resolution="Investigate error and retry assessment",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/",
+                reference=AGENTCORE_STARTER_TOOLKIT_URL,
                 severity=SeverityEnum.HIGH,
                 status=StatusEnum.FAILED,
             )
@@ -1181,7 +1210,7 @@ def check_agentcore_observability() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Observability Check",
                 finding_details="AgentCore client not available in this region",
                 resolution="Deploy in a region where Amazon Bedrock AgentCore is available",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/",
+                reference=AGENTCORE_OBSERVABILITY_REFERENCE_URL,
                 severity=SeverityEnum.INFORMATIONAL,
                 status=StatusEnum.NA,
             )
@@ -1224,7 +1253,7 @@ def check_agentcore_observability() -> List[Dict[str, Any]]:
                                     finding_name="AgentCore Runtime CloudWatch Logs",
                                     finding_details=f"Runtime '{runtime_name}' ({runtime_id}) does not have CloudWatch Logs configured",
                                     resolution="Enable CloudWatch Logs for monitoring and troubleshooting",
-                                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/",
+                                    reference=AGENTCORE_OBSERVABILITY_REFERENCE_URL,
                                     severity=SeverityEnum.MEDIUM,
                                     status=StatusEnum.FAILED,
                                 )
@@ -1248,7 +1277,7 @@ def check_agentcore_observability() -> List[Dict[str, Any]]:
                                                 finding_name="AgentCore Runtime Log Group Missing",
                                                 finding_details=f"Runtime '{runtime_name}' has CloudWatch Logs configured but log group '{log_group_name}' does not exist",
                                                 resolution="Create the log group or update runtime configuration",
-                                                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/",
+                                                reference=AGENTCORE_OBSERVABILITY_REFERENCE_URL,
                                                 severity=SeverityEnum.MEDIUM,
                                                 status=StatusEnum.FAILED,
                                             )
@@ -1265,7 +1294,7 @@ def check_agentcore_observability() -> List[Dict[str, Any]]:
                                     finding_name="AgentCore Runtime X-Ray Tracing",
                                     finding_details=f"Runtime '{runtime_name}' ({runtime_id}) does not have X-Ray tracing enabled",
                                     resolution="Enable X-Ray tracing for distributed tracing and performance analysis",
-                                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/",
+                                    reference=AGENTCORE_OBSERVABILITY_REFERENCE_URL,
                                     severity=SeverityEnum.MEDIUM,
                                     status=StatusEnum.FAILED,
                                 )
@@ -1288,7 +1317,7 @@ def check_agentcore_observability() -> List[Dict[str, Any]]:
                         finding_name="AgentCore Observability Check",
                         finding_details="All AgentCore resources have proper observability configuration",
                         resolution="No action required",
-                        reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/",
+                        reference=AGENTCORE_OBSERVABILITY_REFERENCE_URL,
                         severity=SeverityEnum.MEDIUM,
                         status=StatusEnum.PASSED,
                     )
@@ -1300,7 +1329,7 @@ def check_agentcore_observability() -> List[Dict[str, Any]]:
                         finding_name="AgentCore Observability Check",
                         finding_details="No AgentCore resources found",
                         resolution="No action required",
-                        reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/",
+                        reference=AGENTCORE_OBSERVABILITY_REFERENCE_URL,
                         severity=SeverityEnum.INFORMATIONAL,
                         status=StatusEnum.NA,
                     )
@@ -1314,7 +1343,7 @@ def check_agentcore_observability() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Observability Check",
                 finding_details=f"Error during check: {str(e)}",
                 resolution="Investigate error and retry assessment",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/",
+                reference=AGENTCORE_OBSERVABILITY_REFERENCE_URL,
                 severity=SeverityEnum.MEDIUM,
                 status=StatusEnum.FAILED,
             )
@@ -1374,7 +1403,7 @@ def check_agentcore_encryption() -> List[Dict[str, Any]]:
                                 finding_name="AgentCore ECR Repository Encryption",
                                 finding_details=f"ECR repository '{repo_name}' does not have encryption enabled",
                                 resolution="Enable encryption with customer-managed KMS keys for better control",
-                                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html",
+                                reference=ECR_ENCRYPTION_REFERENCE_URL,
                                 severity=SeverityEnum.HIGH,
                                 status=StatusEnum.FAILED,
                             )
@@ -1386,7 +1415,7 @@ def check_agentcore_encryption() -> List[Dict[str, Any]]:
                                 finding_name="AgentCore ECR Repository AWS-Managed Keys",
                                 finding_details=f"ECR repository '{repo_name}' uses AWS-managed keys instead of customer-managed KMS keys",
                                 resolution="Consider using customer-managed KMS keys for better control and audit capabilities",
-                                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html",
+                                reference=ECR_ENCRYPTION_REFERENCE_URL,
                                 severity=SeverityEnum.LOW,
                                 status=StatusEnum.FAILED,
                             )
@@ -1407,7 +1436,7 @@ def check_agentcore_encryption() -> List[Dict[str, Any]]:
                         finding_name="AgentCore Encryption Check",
                         finding_details="All AgentCore resources have proper encryption configuration",
                         resolution="No action required",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html",
+                        reference=AGENTCORE_DATA_ENCRYPTION_REFERENCE_URL,
                         severity=SeverityEnum.HIGH,
                         status=StatusEnum.PASSED,
                     )
@@ -1419,7 +1448,7 @@ def check_agentcore_encryption() -> List[Dict[str, Any]]:
                         finding_name="AgentCore Encryption Check",
                         finding_details="No AgentCore resources found",
                         resolution="No action required",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html",
+                        reference=AGENTCORE_DATA_ENCRYPTION_REFERENCE_URL,
                         severity=SeverityEnum.INFORMATIONAL,
                         status=StatusEnum.NA,
                     )
@@ -1433,7 +1462,7 @@ def check_agentcore_encryption() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Encryption Check",
                 finding_details=f"Error during check: {str(e)}",
                 resolution="Investigate error and retry assessment",
-                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html",
+                reference=AGENTCORE_DATA_ENCRYPTION_REFERENCE_URL,
                 severity=SeverityEnum.HIGH,
                 status=StatusEnum.FAILED,
             )
@@ -1461,7 +1490,7 @@ def check_browser_tool_recording() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Browser Tool Recording Check",
                 finding_details="AgentCore client not available in this region",
                 resolution="Deploy in a region where Amazon Bedrock AgentCore is available",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/",
+                reference=AGENTCORE_BROWSER_REFERENCE_URL,
                 severity=SeverityEnum.INFORMATIONAL,
                 status=StatusEnum.NA,
             )
@@ -1485,7 +1514,7 @@ def check_browser_tool_recording() -> List[Dict[str, Any]]:
                     finding_name="AgentCore Browser Tool Recording Check",
                     finding_details="No AgentCore Runtimes found to check browser tool configuration",
                     resolution="No action required",
-                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/",
+                    reference=AGENTCORE_BROWSER_REFERENCE_URL,
                     severity=SeverityEnum.INFORMATIONAL,
                     status=StatusEnum.NA,
                 )
@@ -1514,7 +1543,7 @@ def check_browser_tool_recording() -> List[Dict[str, Any]]:
                             finding_name="AgentCore Runtime Storage Configuration",
                             finding_details=f"Runtime '{runtime_name}' ({runtime_id}) does not have storage configuration for browser tools",
                             resolution="Configure S3 storage for browser tool session recordings and artifacts",
-                            reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/",
+                            reference=AGENTCORE_BROWSER_REFERENCE_URL,
                             severity=SeverityEnum.MEDIUM,
                             status=StatusEnum.FAILED,
                         )
@@ -1532,7 +1561,7 @@ def check_browser_tool_recording() -> List[Dict[str, Any]]:
                     finding_name="AgentCore Browser Tool Recording Check",
                     finding_details=f"All {len(runtimes)} Runtimes have proper storage configuration",
                     resolution="No action required",
-                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/",
+                    reference=AGENTCORE_BROWSER_REFERENCE_URL,
                     severity=SeverityEnum.MEDIUM,
                     status=StatusEnum.PASSED,
                 )
@@ -1546,7 +1575,7 @@ def check_browser_tool_recording() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Browser Tool Recording Check",
                 finding_details=f"Error during check: {str(e)}",
                 resolution="Investigate error and retry assessment",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/",
+                reference=AGENTCORE_BROWSER_REFERENCE_URL,
                 severity=SeverityEnum.MEDIUM,
                 status=StatusEnum.FAILED,
             )
@@ -1575,7 +1604,7 @@ def check_agentcore_memory_configuration() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Memory Configuration Check",
                 finding_details="AgentCore client not available in this region",
                 resolution="Deploy in a region where Amazon Bedrock AgentCore is available",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/",
+                reference=AGENTCORE_MEMORY_REFERENCE_URL,
                 severity=SeverityEnum.INFORMATIONAL,
                 status=StatusEnum.NA,
             )
@@ -1595,7 +1624,7 @@ def check_agentcore_memory_configuration() -> List[Dict[str, Any]]:
                     finding_name="AgentCore Memory Configuration Check",
                     finding_details="No Memory resources found",
                     resolution="No action required",
-                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/",
+                    reference=AGENTCORE_MEMORY_REFERENCE_URL,
                     severity=SeverityEnum.INFORMATIONAL,
                     status=StatusEnum.NA,
                 )
@@ -1627,7 +1656,7 @@ def check_agentcore_memory_configuration() -> List[Dict[str, Any]]:
                             finding_name="AgentCore Memory Encryption",
                             finding_details=f"Memory '{memory_name}' ({memory_id}) does not have customer-managed encryption configured",
                             resolution="Enable encryption with customer-managed KMS keys",
-                            reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/",
+                            reference=AGENTCORE_MEMORY_REFERENCE_URL,
                             severity=SeverityEnum.MEDIUM,
                             status=StatusEnum.FAILED,
                         )
@@ -1645,7 +1674,7 @@ def check_agentcore_memory_configuration() -> List[Dict[str, Any]]:
                     finding_name="AgentCore Memory Configuration Check",
                     finding_details=f"All {len(memories)} Memory resources have proper configuration",
                     resolution="No action required",
-                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/",
+                    reference=AGENTCORE_MEMORY_REFERENCE_URL,
                     severity=SeverityEnum.HIGH,
                     status=StatusEnum.PASSED,
                 )
@@ -1659,7 +1688,7 @@ def check_agentcore_memory_configuration() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Memory Configuration Check",
                 finding_details=f"Error during check: {str(e)}",
                 resolution="Investigate error and retry assessment",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/",
+                reference=AGENTCORE_MEMORY_REFERENCE_URL,
                 severity=SeverityEnum.MEDIUM,
                 status=StatusEnum.FAILED,
             )
@@ -2493,7 +2522,7 @@ def check_agentcore_gateway_configuration() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Gateway Configuration Check",
                 finding_details="AgentCore client not available in this region",
                 resolution="Deploy in a region where Amazon Bedrock AgentCore is available",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/",
+                reference=AGENTCORE_GATEWAY_REFERENCE_URL,
                 severity=SeverityEnum.INFORMATIONAL,
                 status=StatusEnum.NA,
             )
@@ -2515,7 +2544,7 @@ def check_agentcore_gateway_configuration() -> List[Dict[str, Any]]:
                         finding_name="AgentCore Gateway Configuration Check",
                         finding_details="No Gateway resources found",
                         resolution="No action required",
-                        reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/",
+                        reference=AGENTCORE_GATEWAY_REFERENCE_URL,
                         severity=SeverityEnum.INFORMATIONAL,
                         status=StatusEnum.NA,
                     )
@@ -2540,7 +2569,7 @@ def check_agentcore_gateway_configuration() -> List[Dict[str, Any]]:
                     finding_name="AgentCore Gateway Configuration Check",
                     finding_details=f"Found {len(gateways)} Gateway resources",
                     resolution="No action required",
-                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/",
+                    reference=AGENTCORE_GATEWAY_REFERENCE_URL,
                     severity=SeverityEnum.MEDIUM,
                     status=StatusEnum.PASSED,
                 )
@@ -2555,7 +2584,7 @@ def check_agentcore_gateway_configuration() -> List[Dict[str, Any]]:
                     finding_name="AgentCore Gateway Configuration Check",
                     finding_details="Gateway API not yet available in bedrock-agentcore-control",
                     resolution="N/A - Gateway management may be done through other means",
-                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/",
+                    reference=AGENTCORE_GATEWAY_REFERENCE_URL,
                     severity=SeverityEnum.INFORMATIONAL,
                     status=StatusEnum.NA,
                 )
@@ -2569,7 +2598,7 @@ def check_agentcore_gateway_configuration() -> List[Dict[str, Any]]:
                         finding_name="AgentCore Gateway Configuration Check",
                         finding_details="No Gateway resources found",
                         resolution="No action required",
-                        reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/",
+                        reference=AGENTCORE_GATEWAY_REFERENCE_URL,
                         severity=SeverityEnum.INFORMATIONAL,
                         status=StatusEnum.NA,
                     )
@@ -2585,7 +2614,7 @@ def check_agentcore_gateway_configuration() -> List[Dict[str, Any]]:
                 finding_name="AgentCore Gateway Configuration Check",
                 finding_details=f"Error during check: {str(e)}",
                 resolution="Investigate error and retry assessment",
-                reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/",
+                reference=AGENTCORE_GATEWAY_REFERENCE_URL,
                 severity=SeverityEnum.MEDIUM,
                 status=StatusEnum.FAILED,
             )
@@ -2949,7 +2978,7 @@ def lambda_handler(event, context):
                             finding_name=f"AgentCore {check_name} Check Error",
                             finding_details=f"Error during {check_name} check: {str(e)}",
                             resolution="Investigate error and retry assessment",
-                            reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/",
+                            reference=AGENTCORE_STARTER_TOOLKIT_URL,
                             severity=SeverityEnum.HIGH,
                             status=StatusEnum.FAILED,
                             region=GLOBAL_REGION_LABEL,
@@ -3016,7 +3045,7 @@ def lambda_handler(event, context):
                     finding_name="AgentCore Service Availability",
                     finding_details=f"Amazon Bedrock AgentCore is not available in region {region}. No checks performed.",
                     resolution="No action required. AgentCore is not deployed in this region.",
-                    reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/",
+                    reference=AGENTCORE_STARTER_TOOLKIT_URL,
                     severity=SeverityEnum.INFORMATIONAL,
                     status=StatusEnum.NA,
                     region=region,
@@ -3093,7 +3122,7 @@ def lambda_handler(event, context):
                         finding_name=f"AgentCore {check_name} Check Error",
                         finding_details=f"Error during {check_name} check: {str(e)}",
                         resolution="Investigate error and retry assessment",
-                        reference="https://aws.github.io/bedrock-agentcore-starter-toolkit/",
+                        reference=AGENTCORE_STARTER_TOOLKIT_URL,
                         severity=SeverityEnum.HIGH,
                         status=StatusEnum.FAILED,
                         region=region,
diff --git a/aiml-security-assessment/functions/security/bedrock_assessments/app.py b/aiml-security-assessment/functions/security/bedrock_assessments/app.py
index 993ed1e..0e9b4bf 100644
--- a/aiml-security-assessment/functions/security/bedrock_assessments/app.py
+++ b/aiml-security-assessment/functions/security/bedrock_assessments/app.py
@@ -878,7 +878,7 @@ def check_bedrock_full_access_roles(
                     finding_name="AmazonBedrockFullAccess role check",
                     finding_details=f"Role '{role['name']}' has AmazonBedrockFullAccess policy attached",
                     resolution="Limit the AmazonBedrockFullAccess policy only to required access",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all\nhttps://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html\nhttps://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html",
                     severity="High",
                     status="Failed",
                     region=region,
@@ -892,7 +892,7 @@ def check_bedrock_full_access_roles(
                 finding_name="AmazonBedrockFullAccess role check",
                 finding_details="No roles found with AmazonBedrockFullAccess policy",
                 resolution="No action required",
-                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all\nhttps://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html",
+                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html\nhttps://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html",
                 severity="High",
                 status="Passed",
                 region=region,
@@ -4172,7 +4172,7 @@ def check_bedrock_agent_action_group_iam(
                         finding_name="Agent Action Group IAM Least Privilege Check",
                         finding_details="No Bedrock agents configured in this region",
                         resolution="When creating agents with action groups, ensure Lambda execution roles follow least privilege principles",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html",
                         severity="High",
                         status="N/A",
                         region=region,
@@ -4340,7 +4340,7 @@ def check_bedrock_agent_action_group_iam(
                             finding_name="Agent Action Group IAM Least Privilege Check",
                             finding_details=f"Lambda function '{lambda_info['function_name']}' used by agent '{lambda_info['agent_name']}' action group '{lambda_info['action_group']}' has role '{lambda_info['role_name']}' with {lambda_info['issue']}. This violates least privilege principles.",
                             resolution="Update the Lambda execution role to use scoped permissions. Remove AdministratorAccess and FullAccess policies. Grant only the specific AWS service permissions needed for the action group's operations. Use Resource-based policies to scope permissions to specific resources.",
-                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html",
+                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html",
                             severity="High",
                             status="Failed",
                             region=region,
@@ -4354,7 +4354,7 @@ def check_bedrock_agent_action_group_iam(
                         finding_name="Agent Action Group IAM Least Privilege Check",
                         finding_details=f"{len(compliant_lambdas)} Lambda functions are using scoped IAM roles",
                         resolution="No action required. Continue using least privilege IAM roles for action group Lambda functions.",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html",
                         severity="Medium",
                         status="Passed",
                         region=region,
@@ -4413,7 +4413,7 @@ def check_bedrock_agent_action_group_iam(
                     finding_name="Agent Action Group IAM Least Privilege Check",
                     finding_details=f"Error during check: {str(e)}",
                     resolution="Investigate error and retry assessment",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html",
                     severity="High",
                     status="Failed",
                     region=region,
@@ -4901,7 +4901,7 @@ def check_bedrock_automated_reasoning_policy(region: str = "") -> Dict[str, Any]
                         finding_name="Automated Reasoning Policy Implementation Check",
                         finding_details="No Bedrock guardrails configured in this region",
                         resolution="Create guardrails with Automated Reasoning policies for formal verification of model responses",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/deploy-automated-reasoning-policy.html",
                         severity="Medium",
                         status="N/A",
                         region=region,
@@ -4961,7 +4961,7 @@ def check_bedrock_automated_reasoning_policy(region: str = "") -> Dict[str, Any]
                             finding_name="Automated Reasoning Policy Implementation Check",
                             finding_details=f"Guardrail '{gr['name']}' (ID: {gr['id']}) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.",
                             resolution="Configure Automated Reasoning policies on guardrails to mathematically verify model responses. Define policies that specify allowed and disallowed behaviors. Use for high-assurance use cases where formal verification is required.",
-                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html",
+                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/deploy-automated-reasoning-policy.html",
                             severity="Medium",
                             status="Failed",
                             region=region,
@@ -4975,7 +4975,7 @@ def check_bedrock_automated_reasoning_policy(region: str = "") -> Dict[str, Any]
                         finding_name="Automated Reasoning Policy Implementation Check",
                         finding_details=f"{len(with_ar_policy)} guardrails have Automated Reasoning policies configured for formal verification",
                         resolution="No action required. Continue using Automated Reasoning for high-assurance verification.",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/deploy-automated-reasoning-policy.html",
                         severity="Low",
                         status="Passed",
                         region=region,
@@ -4998,7 +4998,7 @@ def check_bedrock_automated_reasoning_policy(region: str = "") -> Dict[str, Any]
                             e, "Automated Reasoning API", region
                         ),
                         resolution="Automated Reasoning may not be available in all regions. Check AWS documentation for regional availability.",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/deploy-automated-reasoning-policy.html",
                         severity="Low",
                         status="N/A",
                         region=region,
@@ -5039,7 +5039,7 @@ def check_bedrock_automated_reasoning_policy(region: str = "") -> Dict[str, Any]
                     finding_name="Automated Reasoning Policy Implementation Check",
                     finding_details=f"Error during check: {str(e)}",
                     resolution="Investigate error and retry assessment",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/deploy-automated-reasoning-policy.html",
                     severity="Medium",
                     status="Failed",
                     region=region,
@@ -5084,7 +5084,7 @@ def check_bedrock_rag_evaluation_jobs(region: str = "") -> Dict[str, Any]:
                         finding_name="RAG Evaluation Jobs Check",
                         finding_details="No Bedrock knowledge bases found in this region",
                         resolution="When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-kb.html",
                         severity="Low",
                         status="N/A",
                         region=region,
@@ -5166,7 +5166,7 @@ def _job_references_kb(name: str, kb_id: str) -> bool:
                                 finding_name="RAG Evaluation Jobs Check",
                                 finding_details=f"Knowledge base '{kb['name']}' (ID: {kb['knowledgeBaseId']}) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.",
                                 resolution="Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.",
-                                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html",
+                                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-kb.html",
                                 severity="Low",
                                 status="Failed",
                                 region=region,
@@ -5180,7 +5180,7 @@ def _job_references_kb(name: str, kb_id: str) -> bool:
                             finding_name="RAG Evaluation Jobs Check",
                             finding_details=f"Found {len(recent_evaluations)} recent RAG evaluation jobs. Regular RAG evaluations help maintain response quality and prevent hallucinations.",
                             resolution="Continue regular RAG evaluations. Review evaluation results and adjust retrieval strategies or knowledge base content as needed.",
-                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html",
+                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-kb.html",
                             severity="Low",
                             status="Passed",
                             region=region,
@@ -5207,7 +5207,7 @@ def _job_references_kb(name: str, kb_id: str) -> bool:
                             e, "RAG evaluation API", region
                         ),
                         resolution="Amazon Bedrock Knowledge Bases or RAG evaluation are not available in this region. No action required.",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-kb.html",
                         severity="Low",
                         status="N/A",
                         region=region,
@@ -5247,7 +5247,7 @@ def _job_references_kb(name: str, kb_id: str) -> bool:
                     finding_name="RAG Evaluation Jobs Check",
                     finding_details=f"Error during check: {str(e)}",
                     resolution="Investigate error and retry assessment",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-kb.html",
                     severity="Low",
                     status="Failed",
                     region=region,
@@ -5654,7 +5654,7 @@ def check_bedrock_agent_guardrail_association(region: str = "") -> Dict[str, Any
                         finding_name="Agent Guardrail Association Check",
                         finding_details="No Bedrock agents configured in this region",
                         resolution="When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use.html",
                         severity="High",
                         status="N/A",
                         region=region,
@@ -5690,7 +5690,7 @@ def check_bedrock_agent_guardrail_association(region: str = "") -> Dict[str, Any
                             finding_name="Agent Guardrail Association Check",
                             finding_details=f"Bedrock agent '{agent['name']}' (ID: {agent['id']}) does not have a guardrail associated. Agent interactions are not subject to content filtering, PII protection, or denied-topic controls.",
                             resolution="Associate a Bedrock guardrail with the agent by setting guardrailConfiguration (guardrailIdentifier and guardrailVersion) on the agent. Prepare the agent after updating so the change takes effect.",
-                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html",
+                            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use.html",
                             severity="High",
                             status="Failed",
                             region=region,
@@ -5704,7 +5704,7 @@ def check_bedrock_agent_guardrail_association(region: str = "") -> Dict[str, Any
                         finding_name="Agent Guardrail Association Check",
                         finding_details=f"{len(agents_with_guardrail)} agents have an associated guardrail",
                         resolution="No action required. Continue associating guardrails with new agents.",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use.html",
                         severity="Low",
                         status="Passed",
                         region=region,
@@ -5724,7 +5724,7 @@ def check_bedrock_agent_guardrail_association(region: str = "") -> Dict[str, Any
                             e, "Bedrock Agents API", region
                         ),
                         resolution="Bedrock Agents may not be available in all regions",
-                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html",
+                        reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use.html",
                         severity="Low",
                         status="N/A",
                         region=region,
@@ -5765,7 +5765,7 @@ def check_bedrock_agent_guardrail_association(region: str = "") -> Dict[str, Any
                     finding_name="Agent Guardrail Association Check",
                     finding_details=f"Error during check: {str(e)}",
                     resolution="Investigate error and retry assessment",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use.html",
                     severity="High",
                     status="Failed",
                     region=region,
@@ -6406,7 +6406,7 @@ def check_bedrock_cloudwatch_alarms(region: str = "") -> Dict[str, Any]:
                             e, "CloudWatch alarm check", region
                         ),
                         resolution="Grant cloudwatch:DescribeAlarms permission to the assessment role",
-                        reference="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-access-control-overview-cw.html",
+                        reference="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/security_iam_id-based-policy-examples.html",
                         severity="Medium",
                         status="Failed",
                         region=region,
diff --git a/aiml-security-assessment/functions/security/finserv_assessments/app.py b/aiml-security-assessment/functions/security/finserv_assessments/app.py
index abfcd39..01a09a0 100644
--- a/aiml-security-assessment/functions/security/finserv_assessments/app.py
+++ b/aiml-security-assessment/functions/security/finserv_assessments/app.py
@@ -437,7 +437,8 @@ def require(inventory: "ResourceInventory | None", field_name: str):
 
 
 # ---------------------------------------------------------------------------
-# SEVERITY METHODOLOGY (see docs/severity-methodology.md + severity-register.md)
+# SEVERITY METHODOLOGY (see docs/SECURITY_CHECKS_FINSERV_SEVERITY_METHODOLOGY.md
+# + docs/SECURITY_CHECKS_FINSERV_SEVERITY_REGISTER.md)
 #
 # Severity = property of the CONTROL (the risk it mitigates), assigned once via a
 # Likelihood (L) x Impact (I) matrix mapped to the AWS Security Hub ASFF label set,
@@ -485,7 +486,7 @@ def _label_from_matrix(impact: int, likelihood: int) -> str:
 
 
 # Authoritative per-finding severity register (keyed by finding-name).
-# Source of truth derived from docs/severity-register.md. The test suite
+# Source of truth derived from docs/SECURITY_CHECKS_FINSERV_SEVERITY_REGISTER.md. The test suite
 # (test_severity_register.py) asserts every emitted severity matches this map.
 # Entries: finding_name -> (severity, disposition). I/L rationale lives in the doc.
 SEVERITY_REGISTER: Dict[str, str] = {
@@ -716,7 +717,7 @@ def _could_not_assess_row(check_id: str, check_name: str, err: Any) -> Dict[str,
     """
     Synthesize one visible finding row for a check that errored out and produced
     no rows. Uses Status="N/A", Severity="Low" (the COULD_NOT_ASSESS disposition —
-    see severity-methodology.md §3.4) so the gap surfaces in the report as an
+    see SECURITY_CHECKS_FINSERV_SEVERITY_METHODOLOGY.md §3.4) so the gap surfaces in the report as an
     unknown/assessment-gap without inflating the Failed count or implying a
     confirmed control failure.
     """
@@ -1250,7 +1251,7 @@ def check_cloudwatch_token_alarms() -> Dict[str, Any]:
                         "- AWS/Bedrock TokensProcessed (threshold based on quota)\n"
                         "- Custom application-level token counters via EMF"
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html",
                     severity="Medium",
                     status="Failed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-05"],
@@ -1266,7 +1267,7 @@ def check_cloudwatch_token_alarms() -> Dict[str, Any]:
                         f"{len(throttle_alarms)} covering throttling."
                     ),
                     resolution="Ensure alarms have SNS actions and are in OK state.",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html",
                     severity="Medium",
                     status="Passed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-05"],
@@ -1495,7 +1496,7 @@ def check_agentcore_policy_engine() -> Dict[str, Any]:
                         finding_name="AgentCore Policy Engine — Access Check",
                         finding_details="Unable to enumerate AgentCore runtimes (access denied or service unavailable in region).",
                         resolution="Ensure assessment role has bedrock-agentcore:ListAgentRuntimes permission.",
-                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                         severity="Low",
                         status="N/A",
                         compliance_frameworks=COMPLIANCE_MAP["FS-08"],
@@ -1511,7 +1512,7 @@ def check_agentcore_policy_engine() -> Dict[str, Any]:
                     finding_name="No AgentCore Runtimes Found",
                     finding_details="No AgentCore runtimes found; policy engine check not applicable.",
                     resolution="If using AgentCore, configure the Policy Engine to authorize tool calls.",
-                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                     severity="Informational",
                     status="N/A",
                     compliance_frameworks=COMPLIANCE_MAP["FS-08"],
@@ -1538,7 +1539,7 @@ def check_agentcore_policy_engine() -> Dict[str, Any]:
                             "Configure an authorizer (Lambda or Cedar policy store) on each AgentCore runtime "
                             "to enforce fine-grained tool-call authorization."
                         ),
-                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                         severity="High",
                         status="Failed",
                         compliance_frameworks=COMPLIANCE_MAP["FS-08"],
@@ -1551,7 +1552,7 @@ def check_agentcore_policy_engine() -> Dict[str, Any]:
                         finding_name="AgentCore Policy Engine Configured",
                         finding_details=f"All {len(runtimes)} runtime(s) have authorizer configurations.",
                         resolution="No action required.",
-                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                         severity="High",
                         status="Passed",
                         compliance_frameworks=COMPLIANCE_MAP["FS-08"],
@@ -1757,7 +1758,7 @@ def check_agent_rate_alarms() -> Dict[str, Any]:
                         "- Lambda invocation errors for agent functions\n"
                         "- Step Functions execution failures and timeouts"
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-agents-cw-metrics.html",
                     severity="Medium",
                     status="Failed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-11"],
@@ -1770,7 +1771,7 @@ def check_agent_rate_alarms() -> Dict[str, Any]:
                     finding_name="Agent Rate Alarms Present",
                     finding_details=f"Found {len(agent_alarms)} agent-related CloudWatch alarm(s).",
                     resolution="No action required.",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-agents-cw-metrics.html",
                     severity="Medium",
                     status="Passed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-11"],
@@ -2026,7 +2027,7 @@ def check_bedrock_model_evaluation_adversarial() -> Dict[str, Any]:
                         "2. Use FMEval library for automated robustness testing.\n"
                         "3. Schedule periodic re-evaluation after model updates."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-automatic.html",
                     severity="Medium",
                     status="Failed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-15"],
@@ -2039,7 +2040,7 @@ def check_bedrock_model_evaluation_adversarial() -> Dict[str, Any]:
                     finding_name="Bedrock Evaluation Jobs Present",
                     finding_details=f"Found {len(evals)} evaluation job(s). Verify adversarial datasets are included.",
                     resolution="Ensure evaluation datasets include adversarial/red-team test cases.",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-automatic.html",
                     severity="Medium",
                     status="Passed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-15"],
@@ -2678,7 +2679,7 @@ def check_guardrail_contextual_grounding(inventory) -> Dict[str, Any]:
                         "Configure Bedrock Guardrails with contextual grounding checks "
                         "(grounding threshold ≥0.7 and relevance threshold ≥0.7 for FinServ use cases)."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html",
                     severity="Informational",
                     status="N/A",
                     compliance_frameworks=COMPLIANCE_MAP["FS-27"],
@@ -2713,7 +2714,7 @@ def check_guardrail_contextual_grounding(inventory) -> Dict[str, Any]:
                         "Also consider enabling Automated Reasoning checks (bedrock:ListAutomatedReasoningPolicies) "
                         "for policy-based formal verification of factual claims — see FS-27 ARC check."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html",
                     severity="High",
                     status="Failed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-27"],
@@ -2729,7 +2730,7 @@ def check_guardrail_contextual_grounding(inventory) -> Dict[str, Any]:
                         "No action required for contextual grounding. "
                         "Also consider enabling Automated Reasoning checks for formal policy verification."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html",
                     severity="High",
                     status="Passed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-27"],
@@ -3045,7 +3046,7 @@ def check_bedrock_evaluation_compliance_datasets() -> Dict[str, Any]:
                     "- UDAP/UDAAP unfair/deceptive practice scenarios\n"
                     "- AML/KYC edge cases"
                 ),
-                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html",
+                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-automatic.html",
                 severity="Informational",
                 status="N/A",
                 compliance_frameworks=COMPLIANCE_MAP["FS-30"],
@@ -3435,7 +3436,7 @@ def check_fmeval_harmful_content() -> Dict[str, Any]:
                     "- Hate speech classification\n"
                     "- Violence/self-harm content"
                 ),
-                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html",
+                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-automatic.html",
                 severity="Informational",
                 status="N/A",
                 compliance_frameworks=COMPLIANCE_MAP["FS-35"],
@@ -3752,7 +3753,7 @@ def check_bedrock_evaluation_bias_datasets() -> Dict[str, Any]:
                     "- Equal opportunity scenarios\n"
                     "- Counterfactual fairness tests"
                 ),
-                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html",
+                reference="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation-automatic.html",
                 severity="Informational",
                 status="N/A",
                 compliance_frameworks=COMPLIANCE_MAP["FS-40"],
@@ -4185,7 +4186,7 @@ def check_guardrail_grounding_threshold(inventory) -> Dict[str, Any]:
                     finding_name="No Guardrails — Grounding Threshold Not Applicable",
                     finding_details="No Bedrock Guardrails configured.",
                     resolution="Configure guardrails with contextual grounding checks.",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html",
                     severity="Informational",
                     status="N/A",
                     compliance_frameworks=COMPLIANCE_MAP["FS-47"],
@@ -4412,7 +4413,7 @@ def check_guardrail_relevance_grounding(inventory) -> Dict[str, Any]:
                         "the user query. Also enable the GROUNDING filter (≥0.7) to block "
                         "responses not supported by the retrieved source context."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html",
                     severity="Medium",
                     status="Failed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-50"],
@@ -4428,7 +4429,7 @@ def check_guardrail_relevance_grounding(inventory) -> Dict[str, Any]:
                         f"{', '.join(guardrails_with_relevance)}."
                     ),
                     resolution="No action required.",
-                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html",
+                    reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html",
                     severity="Medium",
                     status="Passed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-50"],
@@ -4811,7 +4812,7 @@ def check_penetration_testing_evidence() -> Dict[str, Any]:
 # CATEGORY 13: IMPROPER OUTPUT HANDLING (FS-55 to FS-58)
 # CATEGORY 14: OFF-TOPIC & INAPPROPRIATE OUTPUT (FS-59 to FS-60)
 # CATEGORY 15: OUT-OF-DATE TRAINING DATA (FS-61 to FS-63)
-# COMPLIANCE_PLACEHOLDER: [SR 11-7, FFIEC CAT, NYDFS 500, OWASP LLM02]
+# COMPLIANCE_PLACEHOLDER: [SR 11-7, FFIEC CAT, NYDFS 500, OWASP LLM05]
 # ===========================================================================
 
 
@@ -4819,7 +4820,7 @@ def check_output_validation_lambda(inventory) -> Dict[str, Any]:
     """
     FS-55 — Check for Lambda functions implementing output validation/sanitization
     in GenAI application pipelines.
-    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, OWASP LLM02]
+    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, OWASP LLM05]
     """
     findings = _empty_findings("Output Validation Lambda Check")
     try:
@@ -4850,7 +4851,7 @@ def check_output_validation_lambda(inventory) -> Dict[str, Any]:
                         "3. Sanitize outputs before rendering in web UIs (XSS prevention).\n"
                         "4. Encode outputs appropriately for the target context (HTML, SQL, JSON)."
                     ),
-                    reference="https://genai.owasp.org/llm-top-10/",
+                    reference="https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/",
                     severity="Medium",
                     status="Failed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-55"],
@@ -4863,7 +4864,7 @@ def check_output_validation_lambda(inventory) -> Dict[str, Any]:
                     finding_name="Output Validation Functions Present",
                     finding_details=f"Found {len(validation_functions)} output validation/sanitization function(s).",
                     resolution="No action required.",
-                    reference="https://genai.owasp.org/llm-top-10/",
+                    reference="https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/",
                     severity="Medium",
                     status="Passed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-55"],
@@ -4877,7 +4878,7 @@ def check_output_validation_lambda(inventory) -> Dict[str, Any]:
 def check_xss_prevention_waf(inventory) -> Dict[str, Any]:
     """
     FS-56 — Verify WAF rules include XSS prevention for GenAI web application outputs.
-    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, PCI-DSS 6.4.1, OWASP LLM02]
+    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, PCI-DSS 6.4.1, OWASP LLM05]
     """
     findings = _empty_findings("XSS Prevention WAF Check")
     try:
@@ -4971,7 +4972,7 @@ def check_output_encoding_advisory() -> Dict[str, Any]:
     """
     FS-57 — Advisory check: verify application encodes GenAI outputs
     appropriately for the rendering context.
-    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, OWASP LLM02]
+    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, OWASP LLM05]
     """
     findings = _empty_findings("Output Encoding Advisory")
     findings["csv_data"].append(
@@ -4988,7 +4989,7 @@ def check_output_encoding_advisory() -> Dict[str, Any]:
                 "3. JSON-encode outputs before embedding in JavaScript contexts.\n"
                 "4. Validate output length and format before passing to downstream APIs."
             ),
-            reference="https://genai.owasp.org/llm-top-10/",
+            reference="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
             severity="Informational",
             status="N/A",
             compliance_frameworks=COMPLIANCE_MAP["FS-57"],
@@ -5001,7 +5002,7 @@ def check_output_schema_validation(inventory) -> Dict[str, Any]:
     """
     FS-58 — Check for structured output validation using Bedrock response
     schemas or application-level JSON schema validation.
-    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, OWASP LLM02]
+    COMPLIANCE_PLACEHOLDER: [NYDFS 500.06, FFIEC CAT, OWASP LLM05]
     """
     findings = _empty_findings("Output Schema Validation Check")
     try:
@@ -5170,7 +5171,7 @@ def check_contextual_grounding_for_offtopic() -> Dict[str, Any]:
                 "2. Use Bedrock Guardrails relevance grounding filter.\n"
                 "3. Test with off-topic prompts in QA to verify rejection behavior."
             ),
-            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html",
+            reference="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html",
             severity="Informational",
             status="N/A",
             compliance_frameworks=COMPLIANCE_MAP["FS-60"],
@@ -5601,7 +5602,7 @@ def check_agentcore_end_user_identity_propagation() -> Dict[str, Any]:
                         finding_name="AgentCore Identity Propagation — Access Check",
                         finding_details="Unable to enumerate AgentCore runtimes (access denied or service unavailable in region).",
                         resolution="Ensure assessment role has bedrock-agentcore:ListAgentRuntimes permission.",
-                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                         severity="Low",
                         status="N/A",
                         compliance_frameworks=COMPLIANCE_MAP["FS-66"],
@@ -5620,7 +5621,7 @@ def check_agentcore_end_user_identity_propagation() -> Dict[str, Any]:
                         "If using AgentCore, configure token propagation so end-user identities "
                         "are forwarded to tool services."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                     severity="Informational",
                     status="N/A",
                     compliance_frameworks=COMPLIANCE_MAP["FS-66"],
@@ -5653,7 +5654,7 @@ def check_agentcore_end_user_identity_propagation() -> Dict[str, Any]:
                         "3. Ensure tool services validate the propagated identity before executing actions.\n"
                         "4. Do not expose propagated identity tokens to unauthorized third parties."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                     severity="High",
                     status="Failed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-66"],
@@ -5666,7 +5667,7 @@ def check_agentcore_end_user_identity_propagation() -> Dict[str, Any]:
                     finding_name="AgentCore End-User Identity Propagation Configured",
                     finding_details=f"All {len(runtimes)} runtime(s) have authorizer configurations supporting identity propagation.",
                     resolution="No action required.",
-                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html",
+                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-oauth.html",
                     severity="High",
                     status="Passed",
                     compliance_frameworks=COMPLIANCE_MAP["FS-66"],
@@ -5722,7 +5723,7 @@ def check_agent_financial_transaction_thresholds(inventory) -> Dict[str, Any]:
                         "a policy constraint on tool calls.\n"
                         "3. Reject or escalate to human review any transaction exceeding defined limits."
                     ),
-                    reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html",
+                    reference="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html",
                     severity="Informational",
                     status="N/A",
                     compliance_frameworks=COMPLIANCE_MAP["FS-67"],
@@ -5765,7 +5766,7 @@ def check_agent_financial_transaction_thresholds(inventory) -> Dict[str, Any]:
                             "3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.\n"
                             "4. Route transactions exceeding thresholds to a human-in-the-loop approval step."
                         ),
-                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html",
+                        reference="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html",
                         severity="High",
                         status="Failed",
                         compliance_frameworks=COMPLIANCE_MAP["FS-67"],
@@ -5781,7 +5782,7 @@ def check_agent_financial_transaction_thresholds(inventory) -> Dict[str, Any]:
                             "threshold/limit environment variables present."
                         ),
                         resolution="Verify threshold values are appropriate for your financial risk tolerance.",
-                        reference="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html",
+                        reference="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html",
                         severity="High",
                         status="Passed",
                         compliance_frameworks=COMPLIANCE_MAP["FS-67"],
diff --git a/aiml-security-assessment/functions/security/finserv_tests/test_severity_register.py b/aiml-security-assessment/functions/security/finserv_tests/test_severity_register.py
index f8ef822..f818b5b 100644
--- a/aiml-security-assessment/functions/security/finserv_tests/test_severity_register.py
+++ b/aiml-security-assessment/functions/security/finserv_tests/test_severity_register.py
@@ -1,5 +1,6 @@
 """
-Drift-guard for the FinServ severity methodology (REQ-6 / severity-register.md).
+Drift-guard for the FinServ severity methodology
+(REQ-6 / SECURITY_CHECKS_FINSERV_SEVERITY_REGISTER.md).
 
 Asserts that:
   1. The Likelihood x Impact matrix helper matches the documented table (methodology §3.3).
diff --git a/aiml-security-assessment/functions/security/generate_consolidated_report/report_template.py b/aiml-security-assessment/functions/security/generate_consolidated_report/report_template.py
index a6688e7..bb6bbe0 100644
--- a/aiml-security-assessment/functions/security/generate_consolidated_report/report_template.py
+++ b/aiml-security-assessment/functions/security/generate_consolidated_report/report_template.py
@@ -98,10 +98,17 @@ def generate_table_rows(findings: List[Dict], include_data_attrs: bool = True) -
             <td><code>{account_id}</code></td>
             <td><code>{region}</code></td>
             <td><code>{check_id}</code></td>
-            <td class="col-domain">{finding_name}</td>
-            <td class="finding-details">{details}</td>
-            <td class="resolution-text">{resolution}</td>
-            <td class="reference-cell">{ref_html}</td>
+            <td class="finding-summary">
+                <div class="col-domain">{finding_name}</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>{details}</p></div>
+                        <div><strong>Resolution</strong><p>{resolution}</p></div>
+                        <div><strong>Reference</strong><p>{ref_html}</p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity {severity_class}">{severity_display}</span></td>
             <td><span class="status {"success" if status_class == "passed" else "error" if status_class == "failed" else "warning"}">{status_display}</span></td>
         </tr>"""
@@ -110,10 +117,39 @@ def generate_table_rows(findings: List[Dict], include_data_attrs: bool = True) -
     return (
         "\n".join(rows)
         if rows
-        else '<tr><td colspan="9" style="text-align: center; padding: 40px; color: var(--text-3);">No findings to display</td></tr>'
+        else '<tr><td colspan="6" style="text-align: center; padding: 40px; color: var(--text-3);">No findings to display</td></tr>'
     )
 
 
+def generate_assessment_summary(
+    service_key: str,
+    total: int,
+    failed: int,
+    passed: int,
+    na_count: int,
+    scope_text: str = "",
+) -> str:
+    """Generate a compact assessment-area summary that filters the main table."""
+    scope_html = (
+        f'<p class="finding-details" style="margin-bottom: 16px;">{scope_text}</p>'
+        if scope_text
+        else ""
+    )
+    return f"""<div class="card"><div class="card-body">
+                    {scope_html}
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">{failed}</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">{passed}</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">{na_count}</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">{total}</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="{service_key}" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="{service_key}" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div>"""
+
+
 def get_html_template() -> str:
     """
     Returns the HTML template string with placeholders.
@@ -236,15 +272,15 @@ def get_html_template() -> str:
         .alert-category {{ font-size: 12px; color: var(--text-2); margin-top: 2px; }}
         .table-wrap {{ overflow-x: auto; max-height: 900px; overflow-y: auto; }}
         table {{ width: 100%; border-collapse: collapse; font-size: 13px; table-layout: fixed; min-width: 1000px; }}
-        table th:nth-child(1) {{ width: 10%; }}
-        table th:nth-child(2) {{ width: 9%; }}
-        table th:nth-child(3) {{ width: 6%; }}
-        table th:nth-child(4) {{ width: 12%; }}
-        table th:nth-child(5) {{ width: 18%; }}
-        table th:nth-child(6) {{ width: 18%; }}
-        table th:nth-child(7) {{ width: 6%; }}
-        table th:nth-child(8) {{ width: 9%; }}
-        table th:nth-child(9) {{ width: 9%; }}
+        #findingsTable th:nth-child(1) {{ width: 13%; }}
+        #findingsTable th:nth-child(2) {{ width: 11%; }}
+        #findingsTable th:nth-child(3) {{ width: 8%; }}
+        #findingsTable th:nth-child(4) {{ width: 46%; }}
+        #findingsTable th:nth-child(5) {{ width: 11%; }}
+        #findingsTable th:nth-child(6) {{ width: 11%; }}
+        #findingsTable.single-account-report {{ min-width: 780px; }}
+        #findingsTable.single-account-report th:nth-child(1),
+        #findingsTable.single-account-report td:nth-child(1) {{ display: none; }}
         th {{ text-align: left; padding: 14px 16px; font-weight: 700; font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; color: var(--text); background: var(--surface-2); border-bottom: 3px solid var(--accent); white-space: nowrap; position: sticky; top: 0; }}
         th.sortable {{ cursor: pointer; user-select: none; transition: background 0.15s; }}
         th.sortable:hover {{ background: var(--border); }}
@@ -282,6 +318,14 @@ def get_html_template() -> str:
         .reference-btn svg {{ width: 14px; height: 14px; }}
         .finding-details {{ color: var(--text-2); font-size: 12px; line-height: 1.6; word-break: break-word; overflow-wrap: break-word; hyphens: auto; }}
         .resolution-text {{ color: var(--text-2); font-size: 12px; line-height: 1.6; word-break: break-word; overflow-wrap: break-word; hyphens: auto; }}
+        .finding-summary {{ text-align: left; }}
+        .finding-more {{ margin-top: 8px; color: var(--text-2); font-size: 12px; }}
+        .finding-more summary {{ cursor: pointer; color: var(--accent); font-weight: 600; }}
+        .finding-more-body {{ display: grid; gap: 10px; margin-top: 10px; padding: 12px; background: var(--surface-2); border-radius: 6px; text-align: left; }}
+        .finding-more-body strong {{ color: var(--text); font-size: 11px; text-transform: uppercase; letter-spacing: 0.3px; }}
+        .finding-more-body p {{ margin-top: 2px; }}
+        .assessment-summary-grid {{ display: grid; grid-template-columns: repeat(4, minmax(140px, 1fr)); gap: 16px; margin-bottom: 16px; }}
+        .assessment-actions {{ display: flex; flex-wrap: wrap; gap: 10px; }}
         @media (max-width: 1024px) {{ .layout {{ grid-template-columns: 1fr; }} .sidebar {{ display: none; }} .metrics {{ grid-template-columns: repeat(2, 1fr); }} }}
         @media (max-width: 640px) {{ .metrics {{ grid-template-columns: 1fr; }} .main {{ padding: 20px; }} }}
         .page-footer {{ padding: 16px 40px; border-top: 1px solid var(--border); font-size: 10px; line-height: 1.6; color: var(--text-3); text-align: center; background: var(--surface); }}
@@ -358,7 +402,7 @@ def get_html_template() -> str:
                 <div class="metrics">
                     <div class="metric"><div class="metric-label">Security Checks</div><div class="metric-value">{security_checks}</div><div class="metric-sub">{security_checks_sub}</div></div>
                     <div class="metric"><div class="metric-label">Total Findings</div><div class="metric-value">{total_findings}</div><div class="metric-sub">{findings_sub}</div></div>
-                    <div class="metric danger"><div class="metric-label">Actionable Findings</div><div class="metric-value">{actionable_findings}</div><div class="metric-sub">High, Medium, and Low severity</div></div>
+                    <div class="metric danger"><div class="metric-label">Actionable Findings</div><div class="metric-value">{actionable_findings}</div><div class="metric-sub">Failed High, Medium, and Low findings</div></div>
                     <div class="metric danger"><div class="metric-label">High Severity</div><div class="metric-value">{high_passed}/{high_count}</div><div class="metric-sub">{high_pass_rate}% passed · Immediate action required</div></div>
                     <div class="metric warning"><div class="metric-label">Medium Severity</div><div class="metric-value">{medium_passed}/{medium_count}</div><div class="metric-sub">{medium_pass_rate}% passed · Should be addressed</div></div>
                     <div class="metric highlight"><div class="metric-label">Low Severity</div><div class="metric-value">{low_passed}/{low_count}</div><div class="metric-sub">{low_pass_rate}% passed · Best practices</div></div>
@@ -379,19 +423,6 @@ def get_html_template() -> str:
                     </div>
                 </div>
             </section>
-            <section id="findings" class="section">
-                <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>All Security Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="searchInput"></div>
-                    {account_filter}
-                    {region_filter}
-                    <div class="filter-group"><label>Assessment Area</label><select id="serviceFilter"><option value="">All Assessment Areas</option><option value="bedrock">Bedrock</option><option value="sagemaker">SageMaker</option><option value="agentcore">AgentCore</option>{agentic_filter_option}{finserv_filter_option}</select></div>
-                    <div class="filter-group"><label>Severity</label><select id="severityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="statusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="resetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="findingsTable"><thead><tr><th class="sortable" data-sort="account">Account ID</th><th class="sortable" data-sort="region">Region</th><th class="sortable" data-sort="checkId">Check ID</th><th class="sortable" data-sort="finding">Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th class="sortable" data-sort="severity">Severity</th><th class="sortable" data-sort="status">Status</th></tr></thead><tbody>{all_rows}</tbody></table></div></div>
-            </section>
             <section id="risk" class="section">
                 <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>Risk Distribution</div>
                 <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Pass Rate by Severity</h4>
@@ -399,7 +430,7 @@ def get_html_template() -> str:
                     <div class="metric danger"><div class="metric-label"><span class="severity high" style="padding: 2px 6px; font-size: 10px;">HIGH</span></div><div class="metric-value">{high_pass_rate}%</div><div class="metric-sub">{high_passed} of {high_count} checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: {high_pass_rate}%; height: 100%; background: var(--danger);"></div></div></div>
                     <div class="metric warning"><div class="metric-label"><span class="severity medium" style="padding: 2px 6px; font-size: 10px;">MEDIUM</span></div><div class="metric-value">{medium_pass_rate}%</div><div class="metric-sub">{medium_passed} of {medium_count} checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: {medium_pass_rate}%; height: 100%; background: var(--warning);"></div></div></div>
                     <div class="metric" style="border-color: var(--accent);"><div class="metric-label"><span class="severity low" style="padding: 2px 6px; font-size: 10px;">LOW</span></div><div class="metric-value" style="color: var(--accent);">{low_pass_rate}%</div><div class="metric-sub">{low_passed} of {low_count} checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: {low_pass_rate}%; height: 100%; background: var(--accent);"></div></div></div>
-                    <div class="metric"><div class="metric-label">Overall</div><div class="metric-value">{pass_rate}%</div><div class="metric-sub">{passed_count} of {actionable_findings} actionable checks</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: {pass_rate}%; height: 100%; background: var(--text-3);"></div></div></div>
+                    <div class="metric"><div class="metric-label">Overall</div><div class="metric-value">{pass_rate}%</div><div class="metric-sub">{passed_count} of {scored_findings} scored checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: {pass_rate}%; height: 100%; background: var(--text-3);"></div></div></div>
                 </div>
                 {account_risk_section}
                 {region_risk_section}
@@ -412,48 +443,35 @@ def get_html_template() -> str:
                     {finserv_service_card}
                 </div>
             </section>
-            <section id="bedrock" class="section">
-                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>Amazon Bedrock Findings</div>
+            <section id="findings" class="section">
+                <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>All Security Findings</div>
                 <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="bedrockSearchInput"></div>
-                    {bedrock_account_filter}
-                    {bedrock_region_filter}
-                    <div class="filter-group"><label>Severity</label><select id="bedrockSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="bedrockStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="bedrockResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
+                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="searchInput"></div>
+                    {account_filter}
+                    {region_filter}
+                    <div class="filter-group"><label>Assessment Area</label><select id="serviceFilter"><option value="">All Assessment Areas</option><option value="bedrock">Bedrock</option><option value="sagemaker">SageMaker</option><option value="agentcore">AgentCore</option>{agentic_filter_option}{finserv_filter_option}</select></div>
+                    <div class="filter-group"><label>Severity</label><select id="severityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
+                    <div class="filter-group"><label>Status</label><select id="statusFilter"><option value="">All Statuses</option><option value="failed" selected>Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
+                    <button class="btn btn-reset" id="resetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
                 </div>
-                <div class="card"><div class="table-wrap"><table id="bedrockTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody>{bedrock_rows}</tbody></table></div></div>
+                <div class="card"><div class="table-wrap"><table id="findingsTable" class="{findings_table_class}"><thead><tr><th class="sortable" data-sort="account">Account ID</th><th class="sortable" data-sort="region">Region</th><th class="sortable" data-sort="checkId">Check ID</th><th class="sortable" data-sort="finding">Finding</th><th class="sortable" data-sort="severity">Severity</th><th class="sortable" data-sort="status">Status</th></tr></thead><tbody>{all_rows}</tbody></table></div></div>
+            </section>
+            <section id="bedrock" class="section">
+                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>Amazon Bedrock Findings</div>
+                {bedrock_summary}
             </section>
             <section id="sagemaker" class="section">
                 <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span>Amazon SageMaker Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="sagemakerSearchInput"></div>
-                    {sagemaker_account_filter}
-                    {sagemaker_region_filter}
-                    <div class="filter-group"><label>Severity</label><select id="sagemakerSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="sagemakerStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="sagemakerResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="sagemakerTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody>{sagemaker_rows}</tbody></table></div></div>
+                {sagemaker_summary}
             </section>
             <section id="agentcore" class="section">
                 <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span>Amazon Bedrock AgentCore Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="agentcoreSearchInput"></div>
-                    {agentcore_account_filter}
-                    {agentcore_region_filter}
-                    <div class="filter-group"><label>Severity</label><select id="agentcoreSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="agentcoreStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="agentcoreResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="agentcoreTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody>{agentcore_rows}</tbody></table></div></div>
+                {agentcore_summary}
             </section>
             {agentic_section}
             {finserv_section}
             <section id="methodology" class="section">
                 <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>Assessment Methodology</div>
-                <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Severity Levels &amp; Status Values</h3></div><div class="card-body" style="padding: 12px 16px;"><table style="width: 100%; font-size: 12px;"><tbody><tr><td style="padding: 4px 12px 4px 0; width: 100px;"><span class="severity high">High</span></td><td style="padding: 4px 0; color: var(--text-2); width: 45%;">Direct security risk</td><td style="padding: 4px 12px 4px 24px; width: 60px;"><span class="status error">Failed</span></td><td style="padding: 4px 0; color: var(--text-2);">Remediation needed</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity medium">Medium</span></td><td style="padding: 4px 0; color: var(--text-2);">Defense-in-depth gap</td><td style="padding: 4px 12px 4px 24px;"><span class="status success">Passed</span></td><td style="padding: 4px 0; color: var(--text-2);">Meets requirements</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity low">Low</span></td><td style="padding: 4px 0; color: var(--text-2);">Best practice</td><td style="padding: 4px 12px 4px 24px;"><span class="status warning">N/A</span></td><td style="padding: 4px 0; color: var(--text-2);">Not applicable</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity na">Informational</span></td><td style="padding: 4px 0; color: var(--text-2);">No action required</td><td></td><td></td></tr></tbody></table></div></div>
-                <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Remediation Guidance</h3></div><div class="card-body" style="padding: 12px 16px;"><table style="width: 100%; font-size: 12px;"><tbody><tr><td style="padding: 4px 12px 4px 0; width: 80px;"><span class="severity high">High</span></td><td style="padding: 4px 0; color: var(--text-2); width: 60px;">7 days</td><td style="padding: 4px 0; color: var(--text-2);">Address immediately; block deployment if unresolved</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity medium">Medium</span></td><td style="padding: 4px 0; color: var(--text-2);">30 days</td><td style="padding: 4px 0; color: var(--text-2);">Schedule in next sprint; may require change window</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity low">Low</span></td><td style="padding: 4px 0; color: var(--text-2);">90 days</td><td style="padding: 4px 0; color: var(--text-2);">Include in backlog; address during regular maintenance</td></tr></tbody></table></div></div>
                 <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Assessment Notes</h3></div><div class="card-body" style="padding: 12px 16px; font-size: 12px; color: var(--text-2); line-height: 1.6;"><strong style="color: var(--text);">Point-in-time:</strong> Security posture changes as resources are modified. <strong style="color: var(--text);">Scope limited:</strong> Passed checks verify tested controls only. <strong style="color: var(--text);">Context matters:</strong> Adjust severity for compliance requirements and environment type.</div></div>
                 <div class="card"><div class="card-header"><h3>Assessment Scope</h3></div><div class="card-body"><div style="display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 12px;"><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon Bedrock</span></div><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon SageMaker</span></div><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon Bedrock AgentCore</span></div></div><p style="color: var(--text-3); font-size: 12px;">Based on AWS Well-Architected Framework (Generative AI Lens) and service-specific security documentation.</p></div></div>
             </section>
@@ -512,7 +530,7 @@ def get_html_template() -> str:
             if (document.getElementById('regionFilter')) document.getElementById('regionFilter').value = '';
             document.getElementById('serviceFilter').value = '';
             document.getElementById('severityFilter').value = '';
-            document.getElementById('statusFilter').value = '';
+            document.getElementById('statusFilter').value = 'failed';
             applyFilters();
         }});
         document.getElementById('searchInput').addEventListener('input', applyFilters);
@@ -521,6 +539,18 @@ def get_html_template() -> str:
         document.getElementById('serviceFilter').addEventListener('change', applyFilters);
         document.getElementById('severityFilter').addEventListener('change', applyFilters);
         document.getElementById('statusFilter').addEventListener('change', applyFilters);
+        function filterFindings(service, status = 'failed') {{
+            document.getElementById('serviceFilter').value = service || '';
+            document.getElementById('statusFilter').value = status;
+            applyFilters();
+            document.getElementById('findings').scrollIntoView({{ behavior: 'smooth' }});
+        }}
+        document.querySelectorAll('[data-filter-service]').forEach(button => {{
+            button.addEventListener('click', function() {{
+                const status = this.hasAttribute('data-filter-status') ? this.dataset.filterStatus : 'failed';
+                filterFindings(this.dataset.filterService, status);
+            }});
+        }});
         window.addEventListener('scroll', () => {{
             const sections = document.querySelectorAll('.section');
             let current = '';
@@ -586,58 +616,6 @@ def get_html_template() -> str:
                 rows.forEach(row => tbody.appendChild(row));
             }});
         }});
-        // Service-specific filter functions
-        function createServiceFilter(tableId, searchId, accountId, regionId, severityId, statusId, resetId) {{
-            const table = document.getElementById(tableId);
-            if (!table) return;
-            const searchInput = document.getElementById(searchId);
-            const accountFilter = document.getElementById(accountId);
-            const regionFilter = document.getElementById(regionId);
-            const severityFilter = document.getElementById(severityId);
-            const statusFilter = document.getElementById(statusId);
-            const resetBtn = document.getElementById(resetId);
-            function applyServiceFilters() {{
-                const searchText = searchInput?.value.toLowerCase() || '';
-                const accountValue = accountFilter?.value.toLowerCase() || '';
-                const regionValue = regionFilter?.value.toLowerCase() || '';
-                const severityValue = severityFilter?.value.toLowerCase() || '';
-                const statusValue = statusFilter?.value.toLowerCase() || '';
-                const rows = table.querySelectorAll('tbody tr');
-                rows.forEach(row => {{
-                    const rowText = row.textContent.toLowerCase();
-                    const rowAccount = row.dataset.account || '';
-                    const rowRegion = row.dataset.region || '';
-                    const rowSeverity = row.dataset.severity || '';
-                    const rowStatus = row.dataset.status || '';
-                    let show = true;
-                    if (searchText && !rowText.includes(searchText)) show = false;
-                    if (accountValue && rowAccount !== accountValue) show = false;
-                    if (regionValue && rowRegion.toLowerCase() !== regionValue) show = false;
-                    if (severityValue && rowSeverity !== severityValue) show = false;
-                    if (statusValue && rowStatus !== statusValue) show = false;
-                    row.style.display = show ? '' : 'none';
-                }});
-            }}
-            searchInput?.addEventListener('input', applyServiceFilters);
-            accountFilter?.addEventListener('change', applyServiceFilters);
-            regionFilter?.addEventListener('change', applyServiceFilters);
-            severityFilter?.addEventListener('change', applyServiceFilters);
-            statusFilter?.addEventListener('change', applyServiceFilters);
-            resetBtn?.addEventListener('click', function() {{
-                if (searchInput) searchInput.value = '';
-                if (accountFilter) accountFilter.value = '';
-                if (regionFilter) regionFilter.value = '';
-                if (severityFilter) severityFilter.value = '';
-                if (statusFilter) statusFilter.value = '';
-                applyServiceFilters();
-            }});
-        }}
-        createServiceFilter('bedrockTable', 'bedrockSearchInput', 'bedrockAccountFilter', 'bedrockRegionFilter', 'bedrockSeverityFilter', 'bedrockStatusFilter', 'bedrockResetFilters');
-        createServiceFilter('sagemakerTable', 'sagemakerSearchInput', 'sagemakerAccountFilter', 'sagemakerRegionFilter', 'sagemakerSeverityFilter', 'sagemakerStatusFilter', 'sagemakerResetFilters');
-        createServiceFilter('agentcoreTable', 'agentcoreSearchInput', 'agentcoreAccountFilter', 'agentcoreRegionFilter', 'agentcoreSeverityFilter', 'agentcoreStatusFilter', 'agentcoreResetFilters');
-        createServiceFilter('agenticTable', 'agenticSearchInput', 'agenticAccountFilter', 'agenticRegionFilter', 'agenticSeverityFilter', 'agenticStatusFilter', 'agenticResetFilters');
-        createServiceFilter('finservTable', 'finservSearchInput', 'finservAccountFilter', 'finservRegionFilter', 'finservSeverityFilter', 'finservStatusFilter', 'finservResetFilters');
-
         // Apply initial filters for main table
         applyFilters();
     </script>
@@ -692,9 +670,13 @@ def generate_html_report(
         for f in all_findings
         if f.get("severity", f.get("Severity", "")).lower() == "low"
     )
-    actionable_findings = (
-        high_count + medium_count + low_count
-    )  # Only High/Medium/Low severity
+    scored_findings = high_count + medium_count + low_count
+    actionable_findings = sum(
+        1
+        for f in all_findings
+        if f.get("severity", f.get("Severity", "")).lower() in {"high", "medium", "low"}
+        and f.get("status", f.get("Status", "")).lower() == "failed"
+    )
 
     # Severity-specific pass rates
     high_passed = sum(
@@ -717,9 +699,7 @@ def generate_html_report(
     )
     passed_count = high_passed + medium_passed + low_passed
     pass_rate = (
-        round((passed_count / actionable_findings * 100), 1)
-        if actionable_findings > 0
-        else 0
+        round((passed_count / scored_findings * 100), 1) if scored_findings > 0 else 0
     )
     high_pass_rate = round((high_passed / high_count * 100), 1) if high_count > 0 else 0
     medium_pass_rate = (
@@ -800,26 +780,11 @@ def generate_html_report(
 
     # Generate table rows
     all_rows = generate_table_rows(all_findings, include_data_attrs=True)
-    bedrock_rows = generate_table_rows(
-        service_findings.get("bedrock", []), include_data_attrs=True
-    )
-    sagemaker_rows = generate_table_rows(
-        service_findings.get("sagemaker", []), include_data_attrs=True
-    )
-    agentcore_rows = generate_table_rows(
-        service_findings.get("agentcore", []), include_data_attrs=True
-    )
-    agentic_rows = generate_table_rows(
-        service_findings.get("agentic", []), include_data_attrs=True
-    )
-    finserv_rows = generate_table_rows(
-        service_findings.get("finserv", []), include_data_attrs=True
-    )
 
     # Build region filter HTML (shared across modes, only shown when multiple regions).
     # "Global" tags IAM-only findings and is intentionally excluded from `regions`
-    # (it must not inflate the region count / tiles), but those findings still appear
-    # in the tables, so surface a "Global" filter option when any are present.
+    # (it must not inflate the scanned region count), but those findings still appear
+    # in the tables and in a separate risk scope card when any are present.
     has_global = any(
         (f.get("region") or f.get("Region")) == "Global" for f in all_findings
     )
@@ -833,16 +798,43 @@ def generate_html_report(
         if has_global:
             region_options += '<option value="Global">Global</option>'
         region_filter = f'<div class="filter-group"><label for="regionFilter">Region</label><select id="regionFilter" onchange="applyFilters()"><option value="">All Regions</option>{region_options}</select></div>'
-        bedrock_region_filter = f'<div class="filter-group"><label for="bedrockRegionFilter">Region</label><select id="bedrockRegionFilter"><option value="">All Regions</option>{region_options}</select></div>'
-        sagemaker_region_filter = f'<div class="filter-group"><label for="sagemakerRegionFilter">Region</label><select id="sagemakerRegionFilter"><option value="">All Regions</option>{region_options}</select></div>'
-        agentcore_region_filter = f'<div class="filter-group"><label for="agentcoreRegionFilter">Region</label><select id="agentcoreRegionFilter"><option value="">All Regions</option>{region_options}</select></div>'
-        agentic_region_filter = f'<div class="filter-group"><label for="agenticRegionFilter">Region</label><select id="agenticRegionFilter"><option value="">All Regions</option>{region_options}</select></div>'
     else:
         region_filter = ""
-        bedrock_region_filter = ""
-        sagemaker_region_filter = ""
-        agentcore_region_filter = ""
-        agentic_region_filter = ""
+
+    def failed_severity_counts(findings: List[Dict]) -> tuple[int, int, int]:
+        high = sum(
+            1
+            for finding in findings
+            if finding.get("severity", finding.get("Severity", "")).lower() == "high"
+            and finding.get("status", finding.get("Status", "")).lower() == "failed"
+        )
+        medium = sum(
+            1
+            for finding in findings
+            if finding.get("severity", finding.get("Severity", "")).lower() == "medium"
+            and finding.get("status", finding.get("Status", "")).lower() == "failed"
+        )
+        low = sum(
+            1
+            for finding in findings
+            if finding.get("severity", finding.get("Severity", "")).lower() == "low"
+            and finding.get("status", finding.get("Status", "")).lower() == "failed"
+        )
+        return high, medium, low
+
+    def risk_metric_card(label: str, high: int, medium: int, low: int) -> str:
+        total_failed = high + medium + low
+        if high > 0:
+            risk_class = "danger"
+            border_color = "var(--danger)"
+        elif medium > 0:
+            risk_class = "warning"
+            border_color = "var(--warning)"
+        else:
+            risk_class = ""
+            border_color = "var(--success)"
+
+        return f"""<div class="metric {risk_class}" style="border-left: 3px solid {border_color};"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">{label}</div><div class="metric-value">{total_failed}</div><div class="metric-sub"><span style="color: var(--danger);">{high} High</span> · <span style="color: var(--warning);">{medium} Med</span> · <span style="color: var(--accent);">{low} Low</span></div></div>"""
 
     # Mode-specific content
     num_accounts = len(account_ids) if account_ids else 1
@@ -865,11 +857,6 @@ def generate_html_report(
             ]
         )
         account_filter = f'<div class="filter-group"><label>Account</label><select id="accountFilter"><option value="">All Accounts</option>{account_options}</select></div>'
-        bedrock_account_filter = f'<div class="filter-group"><label>Account</label><select id="bedrockAccountFilter"><option value="">All Accounts</option>{account_options}</select></div>'
-        sagemaker_account_filter = f'<div class="filter-group"><label>Account</label><select id="sagemakerAccountFilter"><option value="">All Accounts</option>{account_options}</select></div>'
-        agentcore_account_filter = f'<div class="filter-group"><label>Account</label><select id="agentcoreAccountFilter"><option value="">All Accounts</option>{account_options}</select></div>'
-        agentic_account_filter = f'<div class="filter-group"><label>Account</label><select id="agenticAccountFilter"><option value="">All Accounts</option>{account_options}</select></div>'
-        finserv_account_filter = f'<div class="filter-group"><label>Account</label><select id="finservAccountFilter"><option value="">All Accounts</option>{account_options}</select></div>'
 
         # Calculate per-account risk metrics
         account_metrics_html = ""
@@ -879,38 +866,10 @@ def generate_html_report(
                 for f in all_findings
                 if f.get("account_id", f.get("Account_ID", "")) == acc_id
             ]
-            acc_high = sum(
-                1
-                for f in acc_findings
-                if f.get("severity", f.get("Severity", "")).lower() == "high"
-                and f.get("status", f.get("Status", "")).lower() == "failed"
-            )
-            acc_medium = sum(
-                1
-                for f in acc_findings
-                if f.get("severity", f.get("Severity", "")).lower() == "medium"
-                and f.get("status", f.get("Status", "")).lower() == "failed"
+            acc_high, acc_medium, acc_low = failed_severity_counts(acc_findings)
+            account_metrics_html += risk_metric_card(
+                acc_id, acc_high, acc_medium, acc_low
             )
-            acc_low = sum(
-                1
-                for f in acc_findings
-                if f.get("severity", f.get("Severity", "")).lower() == "low"
-                and f.get("status", f.get("Status", "")).lower() == "failed"
-            )
-            acc_total_failed = acc_high + acc_medium + acc_low
-
-            # Determine risk level color
-            if acc_high > 0:
-                risk_class = "danger"
-                border_color = "var(--danger)"
-            elif acc_medium > 0:
-                risk_class = "warning"
-                border_color = "var(--warning)"
-            else:
-                risk_class = ""
-                border_color = "var(--success)"
-
-            account_metrics_html += f"""<div class="metric {risk_class}" style="border-left: 3px solid {border_color};"><div class="metric-label" style="font-family: \'JetBrains Mono\', monospace; font-size: 12px;">{acc_id}</div><div class="metric-value">{acc_total_failed}</div><div class="metric-sub"><span style="color: var(--danger);">{acc_high} High</span> · <span style="color: var(--warning);">{acc_medium} Med</span> · <span style="color: var(--accent);">{acc_low} Low</span></div></div>"""
 
         account_risk_section = f"""<h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Account</h4>
                 <div class="metrics" style="margin-bottom: 32px;">{account_metrics_html}</div>"""
@@ -929,53 +888,32 @@ def generate_html_report(
             findings_sub = "Across 1 account"
             security_checks_sub = "Evaluated per account"
         account_filter = ""
-        bedrock_account_filter = ""
-        sagemaker_account_filter = ""
-        agentcore_account_filter = ""
-        agentic_account_filter = ""
-        finserv_account_filter = ""
         account_risk_section = ""
 
-    # Build region risk section (shown when multiple regions)
-    if regions and len(regions) > 1:
+    # Build region / scope risk section (shown when multiple regions or global risks exist).
+    if (regions and len(regions) > 1) or has_global:
         region_metrics_html = ""
-        for reg in sorted(regions):
+        for reg in sorted(regions or []):
             reg_findings = [
                 f for f in all_findings if f.get("region", f.get("Region", "")) == reg
             ]
-            reg_high = sum(
-                1
-                for f in reg_findings
-                if f.get("severity", f.get("Severity", "")).lower() == "high"
-                and f.get("status", f.get("Status", "")).lower() == "failed"
-            )
-            reg_medium = sum(
-                1
-                for f in reg_findings
-                if f.get("severity", f.get("Severity", "")).lower() == "medium"
-                and f.get("status", f.get("Status", "")).lower() == "failed"
+            reg_high, reg_medium, reg_low = failed_severity_counts(reg_findings)
+            region_metrics_html += risk_metric_card(reg, reg_high, reg_medium, reg_low)
+
+        if has_global:
+            global_findings = [
+                f
+                for f in all_findings
+                if f.get("region", f.get("Region", "")) == "Global"
+            ]
+            global_high, global_medium, global_low = failed_severity_counts(
+                global_findings
             )
-            reg_low = sum(
-                1
-                for f in reg_findings
-                if f.get("severity", f.get("Severity", "")).lower() == "low"
-                and f.get("status", f.get("Status", "")).lower() == "failed"
+            region_metrics_html += risk_metric_card(
+                "Global", global_high, global_medium, global_low
             )
-            reg_total_failed = reg_high + reg_medium + reg_low
-
-            if reg_high > 0:
-                risk_class = "danger"
-                border_color = "var(--danger)"
-            elif reg_medium > 0:
-                risk_class = "warning"
-                border_color = "var(--warning)"
-            else:
-                risk_class = ""
-                border_color = "var(--success)"
-
-            region_metrics_html += f"""<div class="metric {risk_class}" style="border-left: 3px solid {border_color};"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">{reg}</div><div class="metric-value">{reg_total_failed}</div><div class="metric-sub"><span style="color: var(--danger);">{reg_high} High</span> · <span style="color: var(--warning);">{reg_medium} Med</span> · <span style="color: var(--accent);">{reg_low} Low</span></div></div>"""
 
-        region_risk_section = f"""<h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Region</h4>
+        region_risk_section = f"""<h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Region / Scope</h4>
                 <div class="metrics" style="margin-bottom: 32px;">{region_metrics_html}</div>"""
     else:
         region_risk_section = ""
@@ -989,23 +927,6 @@ def generate_html_report(
     agentic_failed = service_stats.get("agentic", {}).get("failed", 0)
     agentic_passed = service_stats.get("agentic", {}).get("passed", 0)
     if agentic_total > 0:
-        agentic_regions = sorted(
-            {
-                f.get("region", f.get("Region", ""))
-                for f in service_findings.get("agentic", [])
-                if f.get("region", f.get("Region", ""))
-            }
-        )
-        agentic_region_options = "".join(
-            [f'<option value="{r}">{r}</option>' for r in agentic_regions]
-        )
-        agentic_region_filter = (
-            '<div class="filter-group"><label>Region</label>'
-            '<select id="agenticRegionFilter">'
-            f'<option value="">All Regions</option>{agentic_region_options}</select></div>'
-            if agentic_regions
-            else agentic_region_filter
-        )
         agentic_nav = (
             '<a href="#agentic" class="nav-item">'
             + AGENTIC_ICON
@@ -1029,20 +950,15 @@ def generate_html_report(
             '<div class="section-title">'
             + AGENTIC_ICON
             + "Agentic AI Security Findings</div>"
-            '<div class="muted" style="margin:-6px 0 10px;font-size:13px;">Scope: API-provable Agentic AI security controls mapped to the AWS Well-Architected Agentic AI Lens security guidance. '
-            "Human-in-the-loop governance is referenced in methodology but not scored automatically unless an AWS API can prove the control.</div>"
-            '<div class="filter-bar">'
-            '<div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="agenticSearchInput"></div>'
-            + agentic_account_filter
-            + agentic_region_filter
-            + '<div class="filter-group"><label>Severity</label><select id="agenticSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>'
-            '<div class="filter-group"><label>Status</label><select id="agenticStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>'
-            '<button class="btn btn-reset" id="agenticResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>'
-            "</div>"
-            '<div class="card"><div class="table-wrap"><table id="agenticTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody>'
-            + agentic_rows
-            + "</tbody></table></div></div>"
-            "</section>"
+            + generate_assessment_summary(
+                "agentic",
+                agentic_total,
+                agentic_failed,
+                agentic_passed,
+                service_stats.get("agentic", {}).get("na", 0),
+                "Scope: API-provable Agentic AI security controls mapped to the AWS Well-Architected Agentic AI Lens security guidance. Human-in-the-loop governance is referenced in methodology but not scored automatically unless an AWS API can prove the control.",
+            )
+            + "</section>"
         )
         agentic_scope_block = (
             '<div class="scope-industry" data-scope-service="agentic">'
@@ -1074,23 +990,6 @@ def generate_html_report(
     finserv_failed = service_stats.get("finserv", {}).get("failed", 0)
     finserv_passed = service_stats.get("finserv", {}).get("passed", 0)
     if finserv_total > 0:
-        finserv_regions = sorted(
-            {
-                f.get("region", f.get("Region", ""))
-                for f in service_findings.get("finserv", [])
-                if f.get("region", f.get("Region", ""))
-            }
-        )
-        finserv_region_options = "".join(
-            [f'<option value="{r}">{r}</option>' for r in finserv_regions]
-        )
-        finserv_region_filter = (
-            '<div class="filter-group"><label>Region</label>'
-            '<select id="finservRegionFilter">'
-            f'<option value="">All Regions</option>{finserv_region_options}</select></div>'
-            if finserv_regions
-            else ""
-        )
         finserv_nav = (
             '<a href="#finserv" class="nav-item industry-item">'
             + FINSERV_ICON
@@ -1125,21 +1024,16 @@ def generate_html_report(
             '<div class="section-title">'
             + FINSERV_ICON
             + "Financial Services GenAI Risk Findings</div>"
-            '<div class="muted" style="margin:-6px 0 10px;font-size:13px;">Scope: this assessment records findings against each resolved CloudFormation TargetRegions entry. These checks are based on '
-            f'<a href="{FINSERV_GUIDE_URL}" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>. '
-            "Severities follow a documented Likelihood &times; Impact methodology (see docs).</div>"
-            '<div class="filter-bar">'
-            '<div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="finservSearchInput"></div>'
-            + finserv_account_filter
-            + finserv_region_filter
-            + '<div class="filter-group"><label>Severity</label><select id="finservSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>'
-            '<div class="filter-group"><label>Status</label><select id="finservStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>'
-            '<button class="btn btn-reset" id="finservResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>'
-            "</div>"
-            '<div class="card"><div class="table-wrap"><table id="finservTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody>'
-            + finserv_rows
-            + "</tbody></table></div></div>"
-            "</section>"
+            + generate_assessment_summary(
+                "finserv",
+                finserv_total,
+                finserv_failed,
+                finserv_passed,
+                service_stats.get("finserv", {}).get("na", 0),
+                "Scope: this assessment records findings against each resolved CloudFormation TargetRegions entry. These checks are based on "
+                f'<a href="{FINSERV_GUIDE_URL}" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>. Severities follow a documented Likelihood &times; Impact methodology.',
+            )
+            + "</section>"
         )
     else:
         finserv_nav = ""
@@ -1150,6 +1044,44 @@ def generate_html_report(
         finserv_scope_source = ""
         finserv_section = ""
 
+    def service_total(service_name: str) -> int:
+        stats = service_stats.get(service_name, {})
+        return stats.get("passed", 0) + stats.get("failed", 0) + stats.get("na", 0)
+
+    bedrock_total = service_total("bedrock")
+    bedrock_failed = service_stats.get("bedrock", {}).get("failed", 0)
+    bedrock_passed = service_stats.get("bedrock", {}).get("passed", 0)
+    bedrock_na = service_stats.get("bedrock", {}).get("na", 0)
+    sagemaker_total = service_total("sagemaker")
+    sagemaker_failed = service_stats.get("sagemaker", {}).get("failed", 0)
+    sagemaker_passed = service_stats.get("sagemaker", {}).get("passed", 0)
+    sagemaker_na = service_stats.get("sagemaker", {}).get("na", 0)
+    agentcore_total = service_total("agentcore")
+    agentcore_failed = service_stats.get("agentcore", {}).get("failed", 0)
+    agentcore_passed = service_stats.get("agentcore", {}).get("passed", 0)
+    agentcore_na = service_stats.get("agentcore", {}).get("na", 0)
+    bedrock_summary = generate_assessment_summary(
+        "bedrock",
+        bedrock_total,
+        bedrock_failed,
+        bedrock_passed,
+        bedrock_na,
+    )
+    sagemaker_summary = generate_assessment_summary(
+        "sagemaker",
+        sagemaker_total,
+        sagemaker_failed,
+        sagemaker_passed,
+        sagemaker_na,
+    )
+    agentcore_summary = generate_assessment_summary(
+        "agentcore",
+        agentcore_total,
+        agentcore_failed,
+        agentcore_passed,
+        agentcore_na,
+    )
+
     # Fill template
     html_template = get_html_template()
 
@@ -1167,6 +1099,7 @@ def generate_html_report(
         total_findings=total_findings,
         findings_sub=findings_sub,
         actionable_findings=actionable_findings,
+        scored_findings=scored_findings,
         total_rows=total_findings,
         high_count=high_count,
         medium_count=medium_count,
@@ -1179,40 +1112,24 @@ def generate_html_report(
         high_pass_rate=high_pass_rate,
         medium_pass_rate=medium_pass_rate,
         low_pass_rate=low_pass_rate,
-        bedrock_total=service_stats.get("bedrock", {}).get("passed", 0)
-        + service_stats.get("bedrock", {}).get("failed", 0)
-        + service_stats.get("bedrock", {}).get("na", 0),
-        bedrock_failed=service_stats.get("bedrock", {}).get("failed", 0),
-        bedrock_passed=service_stats.get("bedrock", {}).get("passed", 0),
-        sagemaker_total=service_stats.get("sagemaker", {}).get("passed", 0)
-        + service_stats.get("sagemaker", {}).get("failed", 0)
-        + service_stats.get("sagemaker", {}).get("na", 0),
-        sagemaker_failed=service_stats.get("sagemaker", {}).get("failed", 0),
-        sagemaker_passed=service_stats.get("sagemaker", {}).get("passed", 0),
-        agentcore_total=service_stats.get("agentcore", {}).get("passed", 0)
-        + service_stats.get("agentcore", {}).get("failed", 0)
-        + service_stats.get("agentcore", {}).get("na", 0),
-        agentcore_failed=service_stats.get("agentcore", {}).get("failed", 0),
-        agentcore_passed=service_stats.get("agentcore", {}).get("passed", 0),
-        agentic_total=service_stats.get("agentic", {}).get("passed", 0)
-        + service_stats.get("agentic", {}).get("failed", 0)
-        + service_stats.get("agentic", {}).get("na", 0),
-        agentic_failed=service_stats.get("agentic", {}).get("failed", 0),
-        agentic_passed=service_stats.get("agentic", {}).get("passed", 0),
+        bedrock_total=bedrock_total,
+        bedrock_failed=bedrock_failed,
+        bedrock_passed=bedrock_passed,
+        sagemaker_total=sagemaker_total,
+        sagemaker_failed=sagemaker_failed,
+        sagemaker_passed=sagemaker_passed,
+        agentcore_total=agentcore_total,
+        agentcore_failed=agentcore_failed,
+        agentcore_passed=agentcore_passed,
+        agentic_total=agentic_total,
+        agentic_failed=agentic_failed,
+        agentic_passed=agentic_passed,
         alerts=alerts_html,
         all_rows=all_rows,
-        bedrock_rows=bedrock_rows,
-        sagemaker_rows=sagemaker_rows,
-        agentcore_rows=agentcore_rows,
-        agentic_rows=agentic_rows,
-        bedrock_account_filter=bedrock_account_filter,
-        sagemaker_account_filter=sagemaker_account_filter,
-        agentcore_account_filter=agentcore_account_filter,
-        agentic_account_filter=agentic_account_filter,
-        bedrock_region_filter=bedrock_region_filter,
-        sagemaker_region_filter=sagemaker_region_filter,
-        agentcore_region_filter=agentcore_region_filter,
-        agentic_region_filter=agentic_region_filter,
+        bedrock_summary=bedrock_summary,
+        sagemaker_summary=sagemaker_summary,
+        agentcore_summary=agentcore_summary,
+        findings_table_class="single-account-report" if mode != "multi" else "",
         agentic_nav=agentic_nav,
         lens_nav=lens_nav,
         agentic_filter_option=agentic_filter_option,
diff --git a/aiml-security-assessment/functions/security/generate_consolidated_report/test_generate_report.py b/aiml-security-assessment/functions/security/generate_consolidated_report/test_generate_report.py
index 4f1c5be..f5cdb7d 100644
--- a/aiml-security-assessment/functions/security/generate_consolidated_report/test_generate_report.py
+++ b/aiml-security-assessment/functions/security/generate_consolidated_report/test_generate_report.py
@@ -178,6 +178,16 @@ def test_generate_viewable_report(self):
             self.assertIn("Methodology", content)
             self.assertIn("Severity Legend", content)
             self.assertIn("sortable", content)
+            self.assertIn("Failed High, Medium, and Low findings", content)
+            self.assertIn('<option value="failed" selected>Failed</option>', content)
+            self.assertIn('class="single-account-report"', content)
+            self.assertIn("Details and remediation", content)
+            self.assertLess(content.index('id="risk"'), content.index('id="findings"'))
+            self.assertIn(
+                "const status = this.hasAttribute('data-filter-status')",
+                content,
+            )
+            self.assertNotIn("this.dataset.filterStatus || 'failed'", content)
 
     def test_generate_multi_account_report(self):
         """Test multi-account report generation using shared template directly"""
@@ -348,13 +358,13 @@ def test_finserv_renders_when_present(self):
         }
         html = generate_html_report(data)
         self.assertIn('id="finserv"', html)
-        self.assertIn('id="finservTable"', html)
+        self.assertIn('id="findingsTable"', html)
+        self.assertNotIn('id="finservTable"', html)
         self.assertIn('<option value="finserv">', html)
         self.assertIn("FS-01", html)
         self.assertIn('data-service="finserv"', html)
-        self.assertIn('id="finservRegionFilter"', html)
-        self.assertIn('<option value="region-a">region-a</option>', html)
-        self.assertIn('<option value="region-b">region-b</option>', html)
+        self.assertIn('data-filter-service="finserv"', html)
+        self.assertIn("View failed findings", html)
         self.assertIn('data-scope-service="finserv"', html)
         self.assertIn('class="scope-industry"', html)
         self.assertIn('class="scope-chip industry-chip"', html)
@@ -407,7 +417,7 @@ def test_agentic_security_renders_when_present(self):
                     "Finding": "Bedrock Agent Guardrail Association",
                     "Finding_Details": "Agent has a guardrail.",
                     "Resolution": "No action required.",
-                    "Reference": "https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html",
+                    "Reference": "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use.html",
                     "Severity": "High",
                     "Status": "Passed",
                     "Region": "us-east-1",
@@ -429,12 +439,14 @@ def test_agentic_security_renders_when_present(self):
         html = generate_html_report(data)
 
         self.assertIn('id="agentic"', html)
-        self.assertIn('id="agenticTable"', html)
+        self.assertIn('id="findingsTable"', html)
+        self.assertNotIn('id="agenticTable"', html)
         self.assertIn('<option value="agentic">Agentic AI Security</option>', html)
         self.assertIn("<h3>By Lens</h3>", html)
         self.assertIn('class="nav-section lens-nav"', html)
         self.assertIn("AG-01", html)
         self.assertIn('data-service="agentic"', html)
+        self.assertIn('data-filter-service="agentic"', html)
         self.assertIn("Agentic AI Security Findings", html)
         self.assertIn(
             "wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html", html
@@ -466,6 +478,74 @@ def test_agentic_security_omitted_when_absent(self):
             "wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html", html
         )
 
+    def test_region_risk_includes_global_scope_card(self):
+        """Global failed findings render in risk by region / scope without inflating regions."""
+        all_findings = [
+            {
+                "account_id": "123456789012",
+                "check_id": "BR-01",
+                "finding": "Regional Bedrock Check",
+                "details": "No regional issue.",
+                "resolution": "No action required.",
+                "reference": "https://example.com",
+                "severity": "High",
+                "status": "Passed",
+                "region": "us-east-1",
+                "_service": "bedrock",
+            },
+            {
+                "account_id": "123456789012",
+                "check_id": "BR-03",
+                "finding": "Marketplace Subscription Access Check",
+                "details": "Overly permissive marketplace subscription access.",
+                "resolution": "Restrict subscription access.",
+                "reference": "https://example.com",
+                "severity": "High",
+                "status": "Failed",
+                "region": "Global",
+                "_service": "bedrock",
+            },
+            {
+                "account_id": "123456789012",
+                "check_id": "AC-09",
+                "finding": "AgentCore Service-Linked Role Missing",
+                "details": "Service-linked role is missing.",
+                "resolution": "Allow service-linked role creation.",
+                "reference": "https://example.com",
+                "severity": "Medium",
+                "status": "Failed",
+                "region": "Global",
+                "_service": "agentcore",
+            },
+        ]
+
+        html = generate_report_direct(
+            all_findings=all_findings,
+            service_findings={
+                "bedrock": all_findings[:2],
+                "agentcore": [all_findings[2]],
+            },
+            service_stats={
+                "bedrock": {"passed": 1, "failed": 1, "na": 0},
+                "agentcore": {"passed": 0, "failed": 1, "na": 0},
+            },
+            mode="single",
+            account_id="123456789012",
+            regions=["eu-west-1", "us-east-1", "us-west-2"],
+        )
+
+        self.assertIn("Risk by Region / Scope", html)
+        self.assertIn('>eu-west-1</div><div class="metric-value">0</div>', html)
+        self.assertIn('>us-east-1</div><div class="metric-value">0</div>', html)
+        self.assertIn('>us-west-2</div><div class="metric-value">0</div>', html)
+        self.assertIn('>Global</div><div class="metric-value">2</div>', html)
+        self.assertIn(
+            '<span style="color: var(--danger);">1 High</span> · '
+            '<span style="color: var(--warning);">1 Med</span> · '
+            '<span style="color: var(--accent);">0 Low</span>',
+            html,
+        )
+
     def tearDown(self):
         """Clean up test files after running tests"""
         pass
diff --git a/aiml-security-assessment/functions/security/sagemaker_assessments/app.py b/aiml-security-assessment/functions/security/sagemaker_assessments/app.py
index 2946b20..d6f1eb0 100644
--- a/aiml-security-assessment/functions/security/sagemaker_assessments/app.py
+++ b/aiml-security-assessment/functions/security/sagemaker_assessments/app.py
@@ -1852,7 +1852,7 @@ def check_sagemaker_monitoring_network_isolation(region: str = "") -> Dict[str,
                         finding_name="SageMaker Monitoring Network Isolation Disabled",
                         finding_details=f"Monitoring schedule '{schedule['name']}' does not have network isolation enabled. Monitoring jobs can make outbound network calls.",
                         resolution="Enable network isolation in the monitoring job definition NetworkConfig to prevent outbound network access.",
-                        reference="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html",
+                        reference="https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_MonitoringNetworkConfig.html",
                         severity="Medium",
                         status="Failed",
                         region=region,
@@ -1867,7 +1867,7 @@ def check_sagemaker_monitoring_network_isolation(region: str = "") -> Dict[str,
                         finding_name="SageMaker Monitoring Network Isolation Check",
                         finding_details=f"All {len(schedules_with_isolation)} monitoring schedules have network isolation enabled",
                         resolution="No action required",
-                        reference="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html",
+                        reference="https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_MonitoringNetworkConfig.html",
                         severity="Medium",
                         status="Passed",
                         region=region,
@@ -1881,7 +1881,7 @@ def check_sagemaker_monitoring_network_isolation(region: str = "") -> Dict[str,
                         finding_name="SageMaker Monitoring Network Isolation Check",
                         finding_details="No monitoring schedules found",
                         resolution="No action required",
-                        reference="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html",
+                        reference="https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_MonitoringNetworkConfig.html",
                         severity="Informational",
                         status="N/A",
                         region=region,
@@ -2902,7 +2902,7 @@ def check_sagemaker_automl_network_isolation(region: str = "") -> Dict[str, Any]
                         finding_name="SageMaker AutoML Job Network Isolation Disabled",
                         finding_details=f"AutoML job '{job['name']}' does not have inter-container traffic encryption enabled. Data transmitted between containers during training is not encrypted.",
                         resolution="Enable EnableInterContainerTrafficEncryption in AutoMLJobConfig.SecurityConfig when creating AutoML jobs.",
-                        reference="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html",
+                        reference="https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_AutoMLSecurityConfig.html",
                         severity="Medium",
                         status="Failed",
                         region=region,
@@ -2916,7 +2916,7 @@ def check_sagemaker_automl_network_isolation(region: str = "") -> Dict[str, Any]
                         finding_name="SageMaker AutoML Job Network Isolation Summary",
                         finding_details=f"Found {len(jobs_without_isolation)} total AutoML jobs without network isolation (showing first 15)",
                         resolution="Review all AutoML jobs and enable inter-container traffic encryption",
-                        reference="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html",
+                        reference="https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_AutoMLSecurityConfig.html",
                         severity="Medium",
                         status="Failed",
                         region=region,
@@ -2931,7 +2931,7 @@ def check_sagemaker_automl_network_isolation(region: str = "") -> Dict[str, Any]
                         finding_name="SageMaker AutoML Job Network Isolation Check",
                         finding_details=f"All {len(jobs_with_isolation)} AutoML jobs have inter-container encryption enabled",
                         resolution="No action required",
-                        reference="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html",
+                        reference="https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_AutoMLSecurityConfig.html",
                         severity="Medium",
                         status="Passed",
                         region=region,
@@ -2945,7 +2945,7 @@ def check_sagemaker_automl_network_isolation(region: str = "") -> Dict[str, Any]
                         finding_name="SageMaker AutoML Job Network Isolation Check",
                         finding_details="No AutoML jobs found",
                         resolution="No action required",
-                        reference="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html",
+                        reference="https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_AutoMLSecurityConfig.html",
                         severity="Informational",
                         status="N/A",
                         region=region,
diff --git a/docs/DEVELOPER_GUIDE.md b/docs/DEVELOPER_GUIDE.md
index 3195cdd..26f0c80 100644
--- a/docs/DEVELOPER_GUIDE.md
+++ b/docs/DEVELOPER_GUIDE.md
@@ -97,7 +97,7 @@ The AI/ML Security Assessment Framework is a serverless, multi-account security
 sample-aiml-security-assessment/
 ├── aiml-security-assessment/
 │   ├── functions/security/
-│   │   ├── bedrock_assessments/      # Bedrock security checks (14)
+│   │   ├── bedrock_assessments/      # Bedrock security checks (32)
 │   │   ├── sagemaker_assessments/    # SageMaker security checks (25)
 │   │   ├── agentcore_assessments/    # AgentCore security checks (13)
 │   │   ├── finserv_assessments/      # Optional Financial Services GenAI risk checks (64)
@@ -116,8 +116,12 @@ sample-aiml-security-assessment/
 ├── deployment/                       # AWS CloudFormation templates
 ├── docs/                             # Documentation
 │   ├── DEVELOPER_GUIDE.md            # This guide
-│   ├── SECURITY_CHECKS.md            # Security checks reference
+│   ├── SECURITY_CHECKS.md            # Security checks reference (core + Agentic)
+│   ├── SECURITY_CHECKS_FINSERV.md    # FinServ GenAI risk checks reference
+│   ├── SECURITY_CHECKS_FINSERV_SEVERITY_METHODOLOGY.md  # FinServ severity model
+│   ├── SECURITY_CHECKS_FINSERV_SEVERITY_REGISTER.md     # FinServ per-finding severities
 │   ├── TROUBLESHOOTING.md            # Troubleshooting guide
+│   ├── CLEANUP.md                    # Resource removal guide
 │   ├── diagrams/                     # Architecture diagrams
 │   └── icons/                        # AWS service icons
 ├── sample-reports/                   # Sample assessment reports
diff --git a/docs/SECURITY_CHECKS.md b/docs/SECURITY_CHECKS.md
index 2b85c52..23393fd 100644
--- a/docs/SECURITY_CHECKS.md
+++ b/docs/SECURITY_CHECKS.md
@@ -87,7 +87,7 @@ Each security check has a unique identifier with a service prefix:
 
 ### SM-04: Amazon GuardDuty Integration
 
-- **Severity:** Medium
+- **Severity:** High
 - **Description:** Verifies Amazon GuardDuty runtime threat detection is enabled.
 
 ### SM-05: MLOps Features
@@ -124,7 +124,7 @@ Each security check has a unique identifier with a service prefix:
 
 ### SM-11: Model Network Isolation
 
-- **Severity:** Medium
+- **Severity:** High
 - **AWS Security Hub Control:** SageMaker.4
 - **Description:** Checks inference containers have network isolation.
 
@@ -417,7 +417,7 @@ Each security check has a unique identifier with a service prefix:
 
 ### AC-07: Memory Encryption
 
-- **Severity:** High
+- **Severity:** Medium
 - **Description:** Checks agent memory encryption with AWS KMS.
 
 ### AC-08: Amazon VPC Endpoints
diff --git a/docs/SECURITY_CHECKS_FINSERV.md b/docs/SECURITY_CHECKS_FINSERV.md
index 7ee559a..13c609d 100644
--- a/docs/SECURITY_CHECKS_FINSERV.md
+++ b/docs/SECURITY_CHECKS_FINSERV.md
@@ -198,14 +198,14 @@ Each FS check maps to one or more FinServ regulatory frameworks (preliminary map
 
 | Framework | Description | Relevant Checks |
 |-----------|-------------|-----------------|
-| SR 11-7 | Federal Reserve Model Risk Management Guidance | FS-07, FS-10, FS-12 to FS-16, FS-20, FS-21, FS-27 to FS-33, FS-34, FS-39 to FS-42, FS-66, FS-67 |
-| FFIEC CAT | Cybersecurity Assessment Tool | All FS checks |
-| NYDFS 500 | NY Cybersecurity Regulation | FS-22, FS-43 to FS-46, FS-51 to FS-54, FS-66 |
-| PCI-DSS | Payment Card Industry Data Security Standard | FS-22, FS-25, FS-26, FS-43 to FS-46, FS-53, FS-56, FS-67, FS-68 |
-| DORA | EU Digital Operational Resilience Act | FS-01 to FS-06, FS-08, FS-11, FS-54, FS-65, FS-68 |
-| MAS TRM 9 | Monetary Authority of Singapore Technology Risk Management | FS-07 to FS-11, FS-15, FS-27 to FS-30, FS-32, FS-37, FS-39 to FS-42, FS-66, FS-67 |
-| ISO 27001 | Information Security Management | FS-13, FS-14, FS-16, FS-21, FS-33, FS-46, FS-52, FS-63, FS-65 |
-| ECOA/Fair Housing | Equal Credit Opportunity Act (US) | FS-39 to FS-42 (advisory — applicability depends on whether the model is used for ECOA-covered credit decisions; confirm with your compliance team) |
+| SR 11-7 | Federal Reserve Model Risk Management Guidance | FS-03, FS-04, FS-06 to FS-10, FS-12 to FS-15, FS-20, FS-21, FS-27 to FS-42, FS-47 to FS-50, FS-59 to FS-63, FS-66, FS-67 |
+| FFIEC CAT | Cybersecurity Assessment Tool | All FS checks except FS-08, FS-56, FS-66 |
+| NYDFS 500 | NY Cybersecurity Regulation | FS-22, FS-24 to FS-26, FS-28 to FS-30, FS-43 to FS-46, FS-51 to FS-54, FS-56, FS-57, FS-66, FS-69 |
+| PCI-DSS | Payment Card Industry Data Security Standard | FS-02, FS-22, FS-24 to FS-26, FS-43 to FS-46, FS-53, FS-56, FS-66 to FS-68 |
+| DORA | EU Digital Operational Resilience Act | FS-01, FS-02, FS-05, FS-11, FS-16, FS-65, FS-68 |
+| MAS TRM 9 | Monetary Authority of Singapore Technology Risk Management | FS-08, FS-10, FS-15, FS-27 to FS-29, FS-32, FS-37, FS-49, FS-62, FS-66, FS-67 |
+| ISO 27001 | Information Security Management | FS-12 to FS-14, FS-16, FS-21, FS-33, FS-46, FS-52, FS-63, FS-65 |
+| ECOA/Fair Housing | Equal Credit Opportunity Act (US) | FS-39, FS-40 (advisory — applicability depends on whether the model is used for ECOA-covered credit decisions; confirm with your compliance team) |
 | OWASP LLM Top 10 | OWASP LLM Application Security | FS-51 to FS-58, FS-68, FS-69 |
 
 > **FS-34 note:** FS-34 (TPRM for FM Providers) is listed above under SR 11-7. Although the
@@ -1016,7 +1016,7 @@ Each FS check maps to one or more FinServ regulatory frameworks (preliminary map
 | Description | Checks for Lambda functions implementing output validation/sanitization before AI responses reach downstream consumers. |
 | Detection | Calls `lambda:ListFunctions` and searches for functions with naming patterns indicating output validation (e.g., "output-valid", "sanitiz", "post-process", "response-filter"). Flags if no such functions exist. |
 | Remediation | 1. Implement a post-processing Lambda that validates AI model output before it reaches the end user or downstream system. 2. Validate output against expected schema (JSON schema validation for structured responses). 3. Strip or escape any executable content (HTML tags, JavaScript, SQL fragments). 4. Log rejected outputs for security monitoring. |
-| Reference | [AWS Well-Architected Security Pillar — Application Security](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/application-security.html), [Bedrock Prompt Injection Security](https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html), [Well-Architected FSI Lens — FSISEC14 Monitor AI system outputs for security issues](https://docs.aws.amazon.com/wellarchitected/latest/financial-services-industry-lens/fsisec14.html) |
+| Reference | [OWASP LLM05:2025 Improper Output Handling](https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/), [AWS Well-Architected Security Pillar — Application Security](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/application-security.html), [Bedrock Prompt Injection Security](https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html), [Well-Architected FSI Lens — FSISEC14 Monitor AI system outputs for security issues](https://docs.aws.amazon.com/wellarchitected/latest/financial-services-industry-lens/fsisec14.html) |
 
 #### FS-56 — XSS Prevention WAF
 
diff --git a/docs/SECURITY_CHECKS_FINSERV_SEVERITY_METHODOLOGY.md b/docs/SECURITY_CHECKS_FINSERV_SEVERITY_METHODOLOGY.md
index 6787733..f9929c7 100644
--- a/docs/SECURITY_CHECKS_FINSERV_SEVERITY_METHODOLOGY.md
+++ b/docs/SECURITY_CHECKS_FINSERV_SEVERITY_METHODOLOGY.md
@@ -123,7 +123,7 @@ a default band. Per-control I×L may refine within ±1 with a documented reason.
 | **Non-verifiable advisory** | app-layer; no API | **Informational** | FS-24, FS-29, FS-32, FS-37, FS-49, FS-54, FS-57, FS-58, FS-60, FS-62 |
 
 The authoritative per-finding assignments are in
-[`severity-register.md`](./severity-register.md).
+[`SECURITY_CHECKS_FINSERV_SEVERITY_REGISTER.md`](./SECURITY_CHECKS_FINSERV_SEVERITY_REGISTER.md).
 
 
 
diff --git a/sample-reports/dashboard-overview-dark.png b/sample-reports/dashboard-overview-dark.png
index a94cd0a..d1f7462 100644
Binary files a/sample-reports/dashboard-overview-dark.png and b/sample-reports/dashboard-overview-dark.png differ
diff --git a/sample-reports/dashboard-overview-light.png b/sample-reports/dashboard-overview-light.png
index af805da..bcca132 100644
Binary files a/sample-reports/dashboard-overview-light.png and b/sample-reports/dashboard-overview-light.png differ
diff --git a/sample-reports/findings-table.png b/sample-reports/findings-table.png
index 948e9ee..af8181b 100644
Binary files a/sample-reports/findings-table.png and b/sample-reports/findings-table.png differ
diff --git a/sample-reports/multi-account-summary.png b/sample-reports/multi-account-summary.png
index 78bbe13..a8c837a 100644
Binary files a/sample-reports/multi-account-summary.png and b/sample-reports/multi-account-summary.png differ
diff --git a/sample-reports/security_assessment_multi_account.html b/sample-reports/security_assessment_multi_account.html
index de48422..36b64d0 100644
--- a/sample-reports/security_assessment_multi_account.html
+++ b/sample-reports/security_assessment_multi_account.html
@@ -114,15 +114,15 @@
         .alert-category { font-size: 12px; color: var(--text-2); margin-top: 2px; }
         .table-wrap { overflow-x: auto; max-height: 900px; overflow-y: auto; }
         table { width: 100%; border-collapse: collapse; font-size: 13px; table-layout: fixed; min-width: 1000px; }
-        table th:nth-child(1) { width: 10%; }
-        table th:nth-child(2) { width: 9%; }
-        table th:nth-child(3) { width: 6%; }
-        table th:nth-child(4) { width: 12%; }
-        table th:nth-child(5) { width: 18%; }
-        table th:nth-child(6) { width: 18%; }
-        table th:nth-child(7) { width: 6%; }
-        table th:nth-child(8) { width: 9%; }
-        table th:nth-child(9) { width: 9%; }
+        #findingsTable th:nth-child(1) { width: 13%; }
+        #findingsTable th:nth-child(2) { width: 11%; }
+        #findingsTable th:nth-child(3) { width: 8%; }
+        #findingsTable th:nth-child(4) { width: 46%; }
+        #findingsTable th:nth-child(5) { width: 11%; }
+        #findingsTable th:nth-child(6) { width: 11%; }
+        #findingsTable.single-account-report { min-width: 780px; }
+        #findingsTable.single-account-report th:nth-child(1),
+        #findingsTable.single-account-report td:nth-child(1) { display: none; }
         th { text-align: left; padding: 14px 16px; font-weight: 700; font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; color: var(--text); background: var(--surface-2); border-bottom: 3px solid var(--accent); white-space: nowrap; position: sticky; top: 0; }
         th.sortable { cursor: pointer; user-select: none; transition: background 0.15s; }
         th.sortable:hover { background: var(--border); }
@@ -160,6 +160,14 @@
         .reference-btn svg { width: 14px; height: 14px; }
         .finding-details { color: var(--text-2); font-size: 12px; line-height: 1.6; word-break: break-word; overflow-wrap: break-word; hyphens: auto; }
         .resolution-text { color: var(--text-2); font-size: 12px; line-height: 1.6; word-break: break-word; overflow-wrap: break-word; hyphens: auto; }
+        .finding-summary { text-align: left; }
+        .finding-more { margin-top: 8px; color: var(--text-2); font-size: 12px; }
+        .finding-more summary { cursor: pointer; color: var(--accent); font-weight: 600; }
+        .finding-more-body { display: grid; gap: 10px; margin-top: 10px; padding: 12px; background: var(--surface-2); border-radius: 6px; text-align: left; }
+        .finding-more-body strong { color: var(--text); font-size: 11px; text-transform: uppercase; letter-spacing: 0.3px; }
+        .finding-more-body p { margin-top: 2px; }
+        .assessment-summary-grid { display: grid; grid-template-columns: repeat(4, minmax(140px, 1fr)); gap: 16px; margin-bottom: 16px; }
+        .assessment-actions { display: flex; flex-wrap: wrap; gap: 10px; }
         @media (max-width: 1024px) { .layout { grid-template-columns: 1fr; } .sidebar { display: none; } .metrics { grid-template-columns: repeat(2, 1fr); } }
         @media (max-width: 640px) { .metrics { grid-template-columns: 1fr; } .main { padding: 20px; } }
         .page-footer { padding: 16px 40px; border-top: 1px solid var(--border); font-size: 10px; line-height: 1.6; color: var(--text-3); text-align: center; background: var(--surface); }
@@ -187,7 +195,7 @@ <h3>Navigation</h3>
                 <a href="#findings" class="nav-item">
                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
                     Security Findings
-                    <span class="count">1664</span>
+                    <span class="count">1124</span>
                 </a>
                 <a href="#risk" class="nav-item">
                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>
@@ -203,23 +211,23 @@ <h3>By Service</h3>
                 <a href="#bedrock" class="nav-item">
                     <span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>
                     Bedrock
-                    <span class="count">461</span>
+                    <span class="count">293</span>
                 </a>
                 <a href="#sagemaker" class="nav-item">
                     <span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span>
                     SageMaker
-                    <span class="count">423</span>
+                    <span class="count">261</span>
                 </a>
                 <a href="#agentcore" class="nav-item">
                     <span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span>
 	                    AgentCore
-	                    <span class="count">182</span>
+	                    <span class="count">122</span>
 	                </a>
 	            </nav>
-	            <nav class="nav-section lens-nav"><h3>By Lens</h3><a href="#agentic" class="nav-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security<span class="count">388</span></a></nav>
-	            <nav class="nav-section industry-nav"><h3>By Industry</h3><a href="#finserv" class="nav-item industry-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services<span class="count">210</span></a></nav>
+	            <nav class="nav-section lens-nav"><h3>By Lens</h3><a href="#agentic" class="nav-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security<span class="count">244</span></a></nav>
+	            <nav class="nav-section industry-nav"><h3>By Industry</h3><a href="#finserv" class="nav-item industry-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services<span class="count">204</span></a></nav>
 	            <div class="sidebar-footer">
-	                <p>Generated: July 09, 2026</p>
+	                <p>Generated: July 10, 2026</p>
 	                <p>Accounts: 3</p>
                 <p style="margin-top: 8px;"><a href="https://github.com/aws-samples/sample-aiml-security-assessment">GitHub Repository</a></p>
             </div>
@@ -229,35 +237,29 @@ <h3>By Service</h3>
                 <div class="page-header">
                     <h2>Security Assessment Overview</h2>
                     <div class="page-header-meta">
-                        <span><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="4" width="18" height="18" rx="2" ry="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg>July 09, 2026 22:34:42 UTC</span>
+                        <span><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="4" width="18" height="18" rx="2" ry="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg>July 10, 2026 03:32:48 UTC</span>
                         <span><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>3 Accounts</span>
                     </div>
                 </div>
                 <div class="metrics">
-                    <div class="metric"><div class="metric-label">Security Checks</div><div class="metric-value">161</div><div class="metric-sub">Evaluated across 5 regions</div></div>
-                    <div class="metric"><div class="metric-label">Total Findings</div><div class="metric-value">1664</div><div class="metric-sub">Across 3 accounts · 5 regions</div></div>
-                    <div class="metric danger"><div class="metric-label">Actionable Findings</div><div class="metric-value">598</div><div class="metric-sub">High, Medium, and Low severity</div></div>
-                    <div class="metric danger"><div class="metric-label">High Severity</div><div class="metric-value">28/219</div><div class="metric-sub">12.8% passed · Immediate action required</div></div>
-                    <div class="metric warning"><div class="metric-label">Medium Severity</div><div class="metric-value">82/280</div><div class="metric-sub">29.3% passed · Should be addressed</div></div>
-                    <div class="metric highlight"><div class="metric-label">Low Severity</div><div class="metric-value">30/99</div><div class="metric-sub">30.3% passed · Best practices</div></div>
+                    <div class="metric"><div class="metric-label">Security Checks</div><div class="metric-value">161</div><div class="metric-sub">Evaluated across 3 regions</div></div>
+                    <div class="metric"><div class="metric-label">Total Findings</div><div class="metric-value">1124</div><div class="metric-sub">Across 3 accounts · 3 regions</div></div>
+                    <div class="metric danger"><div class="metric-label">Actionable Findings</div><div class="metric-value">260</div><div class="metric-sub">Failed High, Medium, and Low findings</div></div>
+                    <div class="metric danger"><div class="metric-label">High Severity</div><div class="metric-value">28/183</div><div class="metric-sub">15.3% passed · Immediate action required</div></div>
+                    <div class="metric warning"><div class="metric-label">Medium Severity</div><div class="metric-value">64/232</div><div class="metric-sub">27.6% passed · Should be addressed</div></div>
+                    <div class="metric highlight"><div class="metric-label">Low Severity</div><div class="metric-value">24/75</div><div class="metric-sub">32.0% passed · Best practices</div></div>
                 </div>
                 <div class="card"><div class="card-header"><h3>Priority Recommendations</h3></div><div class="card-body"><div class="alerts"><div class="alert-item critical">
-            <div class="alert-count">1</div>
-            <div class="alert-info">
-                <div class="alert-domain">AgentCore Resource-Based Policies Missing</div>
-                <div class="alert-category">AgentCore</div>
-            </div>
-        </div><div class="alert-item critical">
-            <div class="alert-count">1</div>
+            <div class="alert-count">3</div>
             <div class="alert-info">
-                <div class="alert-domain">Agentic AI Gateway Tool Policy Enforcement Missing</div>
-                <div class="alert-category">Agentic AI</div>
+                <div class="alert-domain">AmazonBedrockFullAccess role check</div>
+                <div class="alert-category">Bedrock</div>
             </div>
         </div><div class="alert-item critical">
             <div class="alert-count">1</div>
             <div class="alert-info">
-                <div class="alert-domain">Agentic AI Resource Policy Boundary</div>
-                <div class="alert-category">Agentic AI</div>
+                <div class="alert-domain">Marketplace Subscription Access Check</div>
+                <div class="alert-category">Bedrock</div>
             </div>
         </div><div class="alert-item warning">
             <div class="alert-count">1</div>
@@ -281,494 +283,433 @@ <h2>Security Assessment Overview</h2>
                     </div>
                 </div>
             </section>
+            <section id="risk" class="section">
+                <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>Risk Distribution</div>
+                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Pass Rate by Severity</h4>
+                <div class="metrics" style="margin-bottom: 32px;">
+                    <div class="metric danger"><div class="metric-label"><span class="severity high" style="padding: 2px 6px; font-size: 10px;">HIGH</span></div><div class="metric-value">15.3%</div><div class="metric-sub">28 of 183 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 15.3%; height: 100%; background: var(--danger);"></div></div></div>
+                    <div class="metric warning"><div class="metric-label"><span class="severity medium" style="padding: 2px 6px; font-size: 10px;">MEDIUM</span></div><div class="metric-value">27.6%</div><div class="metric-sub">64 of 232 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 27.6%; height: 100%; background: var(--warning);"></div></div></div>
+                    <div class="metric" style="border-color: var(--accent);"><div class="metric-label"><span class="severity low" style="padding: 2px 6px; font-size: 10px;">LOW</span></div><div class="metric-value" style="color: var(--accent);">32.0%</div><div class="metric-sub">24 of 75 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 32.0%; height: 100%; background: var(--accent);"></div></div></div>
+                    <div class="metric"><div class="metric-label">Overall</div><div class="metric-value">23.7%</div><div class="metric-sub">116 of 490 scored checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 23.7%; height: 100%; background: var(--text-3);"></div></div></div>
+                </div>
+                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Account</h4>
+                <div class="metrics" style="margin-bottom: 32px;"><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">111122223333</div><div class="metric-value">193</div><div class="metric-sub"><span style="color: var(--danger);">78 High</span> · <span style="color: var(--warning);">95 Med</span> · <span style="color: var(--accent);">20 Low</span></div></div><div class="metric warning" style="border-left: 3px solid var(--warning);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">444455556666</div><div class="metric-value">3</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">3 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">777788889999</div><div class="metric-value">64</div><div class="metric-sub"><span style="color: var(--danger);">28 High</span> · <span style="color: var(--warning);">31 Med</span> · <span style="color: var(--accent);">5 Low</span></div></div></div>
+                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Region / Scope</h4>
+                <div class="metrics" style="margin-bottom: 32px;"><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">eu-west-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-east-1</div><div class="metric-value">157</div><div class="metric-sub"><span style="color: var(--danger);">52 High</span> · <span style="color: var(--warning);">90 Med</span> · <span style="color: var(--accent);">15 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-west-2</div><div class="metric-value">64</div><div class="metric-sub"><span style="color: var(--danger);">22 High</span> · <span style="color: var(--warning);">32 Med</span> · <span style="color: var(--accent);">10 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">Global</div><div class="metric-value">39</div><div class="metric-sub"><span style="color: var(--danger);">32 High</span> · <span style="color: var(--warning);">7 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div></div>
+                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Findings by Assessment Area</h4>
+                <div class="metrics">
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span> Bedrock</div><div class="metric-value">293</div><div class="metric-sub">50 Failed · 18 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span> SageMaker</div><div class="metric-value">261</div><div class="metric-sub">34 Failed · 37 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span> AgentCore</div><div class="metric-value">122</div><div class="metric-sub">39 Failed · 3 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security</div><div class="metric-value">244</div><div class="metric-sub">47 Failed &middot; 18 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services Risk</div><div class="metric-value">204</div><div class="metric-sub">90 Failed · 40 Passed</div></div>
+                </div>
+            </section>
             <section id="findings" class="section">
                 <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>All Security Findings</div>
                 <div class="filter-bar">
                     <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="searchInput"></div>
                     <div class="filter-group"><label>Account</label><select id="accountFilter"><option value="">All Accounts</option><option value="111122223333">111122223333</option><option value="444455556666">444455556666</option><option value="777788889999">777788889999</option></select></div>
-                    <div class="filter-group"><label for="regionFilter">Region</label><select id="regionFilter" onchange="applyFilters()"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
+                    <div class="filter-group"><label for="regionFilter">Region</label><select id="regionFilter" onchange="applyFilters()"><option value="">All Regions</option><option value="eu-west-1">eu-west-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
                     <div class="filter-group"><label>Assessment Area</label><select id="serviceFilter"><option value="">All Assessment Areas</option><option value="bedrock">Bedrock</option><option value="sagemaker">SageMaker</option><option value="agentcore">AgentCore</option><option value="agentic">Agentic AI Security</option><option value="finserv">Financial Services</option></select></div>
                     <div class="filter-group"><label>Severity</label><select id="severityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="statusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
+                    <div class="filter-group"><label>Status</label><select id="statusFilter"><option value="">All Statuses</option><option value="failed" selected>Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
                     <button class="btn btn-reset" id="resetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
                 </div>
-                <div class="card"><div class="table-wrap"><table id="findingsTable"><thead><tr><th class="sortable" data-sort="account">Account ID</th><th class="sortable" data-sort="region">Region</th><th class="sortable" data-sort="checkId">Check ID</th><th class="sortable" data-sort="finding">Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th class="sortable" data-sort="severity">Severity</th><th class="sortable" data-sort="status">Status</th></tr></thead><tbody><tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+                <div class="card"><div class="table-wrap"><table id="findingsTable" class=""><thead><tr><th class="sortable" data-sort="account">Account ID</th><th class="sortable" data-sort="region">Region</th><th class="sortable" data-sort="checkId">Check ID</th><th class="sortable" data-sort="finding">Finding</th><th class="sortable" data-sort="severity">Severity</th><th class="sortable" data-sort="status">Status</th></tr></thead><tbody><tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">Found 1 Gateway resources</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Missing</td>
-            <td class="finding-details">The following AgentCore resources do not have resource-based policies: Gateway 'aws-news-mcp'. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to:
-1. Implement defense-in-depth access control
-2. Enable cross-account access control
-3. Restrict access based on source VPC or IP
-4. Implement hierarchical authorization for Agent Runtimes</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Missing</td>
-            <td class="finding-details">The following Gateways do not use customer-managed KMS encryption: 'aws-news-mcp'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">1. Create gateways with customer-managed KMS keys for additional control
-2. AWS-managed keys are single-tenant and region-specific
-3. Consider CMK for enhanced audit capabilities and key rotation control</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) uses authorizerType CUSTOM_JWT.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</td>
-            <td class="resolution-text">Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) does not expose DEBUG-level exception detail.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection Missing</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) is not associated with an AWS WAF web ACL.</td>
-            <td class="resolution-text">Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: The following AgentCore resources do not have resource-based policies: Gateway 'aws-news-mcp'. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: The following Gateways do not use customer-managed KMS encryption: 'aws-news-mcp'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
 <tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AmazonBedrockFullAccess role check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has AmazonBedrockFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Limit the AmazonBedrockFullAccess policy only to required access</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
+https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -776,11 +717,18 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AmazonBedrockFullAccess role check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has AmazonBedrockFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Limit the AmazonBedrockFullAccess policy only to required access</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
+https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -788,11 +736,18 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'myAskMeAnything-role-kmsizqwf' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AmazonBedrockFullAccess role check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'myAskMeAnything-role-kmsizqwf' has AmazonBedrockFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Limit the AmazonBedrockFullAccess policy only to required access</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
+https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -800,10 +755,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-cdk_agent_core'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-cdk_agent_core'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -811,10 +773,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-neoCyan_Agent'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-neoCyan_Agent'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -822,10 +791,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockExecutionRoleForKnowledgeBase_knnc9' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_knnc9'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonBedrockExecutionRoleForKnowledgeBase_knnc9' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_knnc9'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -833,10 +809,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockExecutionRoleForKnowledgeBase_qxqw2' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_qxqw2'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonBedrockExecutionRoleForKnowledgeBase_qxqw2' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_qxqw2'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -844,10 +827,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonSageMaker-ExecutionRole-20250525T153161' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonSageMaker-ExecutionRole-20250525T153161' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -855,10 +845,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -866,10 +863,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -877,10 +881,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'myAskMeAnything-role-kmsizqwf' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'myAskMeAnything-role-kmsizqwf' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -888,10 +899,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">User 'BedrockAPIKey-20pp' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>User 'BedrockAPIKey-20pp' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -899,10 +917,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">User 'BedrockAPIKey-yhc3' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>User 'BedrockAPIKey-yhc3' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -910,10 +935,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">User 'BedrockClientUser' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>User 'BedrockClientUser' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -921,14 +953,21 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity not used</td>
-            <td class="finding-details">No Bedrock service VPC endpoints found in VPCs: vpc-03472be90d65c2f68, vpc-39319f44, vpc-064f3e808e378cbc8, vpc-02d020a365a06c7fe</td>
-            <td class="resolution-text">Create a VPC endpoint in your VPC with any of the following Bedrock service endpoints that your application may be using:
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity not used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock service VPC endpoints found in VPCs: vpc-03472be90d65c2f68, vpc-39319f44, vpc-064f3e808e378cbc8, vpc-02d020a365a06c7fe</p></div>
+                        <div><strong>Resolution</strong><p>Create a VPC endpoint in your VPC with any of the following Bedrock service endpoints that your application may be using:
 - com.amazonaws.region.bedrock
 - com.amazonaws.region.bedrock-runtime
 - com.amazonaws.region.bedrock-agent
-- com.amazonaws.region.bedrock-agent-runtime</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+- com.amazonaws.region.bedrock-agent-runtime</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -936,10 +975,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">Model invocation logging is properly configured with delivery to: Amazon S3, CloudWatch Logs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging is properly configured with delivery to: Amazon S3, CloudWatch Logs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -947,10 +993,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">Amazon Bedrock Guardrails are properly configured with 1 guardrails</td>
-            <td class="resolution-text">No action required. Continue monitoring and updating guardrails as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon Bedrock Guardrails are properly configured with 1 guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue monitoring and updating guardrails as needed.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -958,10 +1011,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">No action required. Continue monitoring CloudTrail logs for Bedrock activity.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue monitoring CloudTrail logs for Bedrock activity.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -969,14 +1029,21 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
 1. Create and version your prompts
 2. Test different prompt variants
 3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -984,10 +1051,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -995,13 +1069,20 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-semiconductors' (RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'knowledge-base-semiconductors' (RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
 2. For S3 data sources: Verify CMK-encrypted S3 buckets
 3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1009,13 +1090,20 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base '111122223333-us-east-1-kb' (PAJOKBSIMQ) uses 'S3_VECTORS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base '111122223333-us-east-1-kb' (PAJOKBSIMQ) uses 'S3_VECTORS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
 2. For S3 data sources: Verify CMK-encrypted S3 buckets
 3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1023,13 +1111,20 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'e2e-rag-knowledgebase' (ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'e2e-rag-knowledgebase' (ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
 2. For S3 data sources: Verify CMK-encrypted S3 buckets
 3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1037,13 +1132,20 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Missing</td>
-            <td class="finding-details">The following roles can invoke Bedrock models without enforced guardrails: 111122223333-us-east-1-kb-bedrock-service-role, agentcore-wildrydes_gateway_role_ab3991f6-role, AgentCoreEvalsSDK-us-east-1-d04ba7b68b, AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76, AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b, AmazonBedrockExecutionRoleForAgents_S0T9VNPP9D, AmazonBedrockExecutionRoleForAgents_WNCOPE29NZ, AmazonBedrockExecutionRoleForKnowledgeBase_072pr, AmazonBedrockExecutionRoleForKnowledgeBase_byjin, AmazonBedrockExecutionRoleForKnowledgeBase_h9718...</td>
-            <td class="resolution-text">Add IAM policy conditions to enforce guardrail usage:
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following roles can invoke Bedrock models without enforced guardrails: 111122223333-us-east-1-kb-bedrock-service-role, agentcore-wildrydes_gateway_role_ab3991f6-role, AgentCoreEvalsSDK-us-east-1-d04ba7b68b, AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76, AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b, AmazonBedrockExecutionRoleForAgents_S0T9VNPP9D, AmazonBedrockExecutionRoleForAgents_WNCOPE29NZ, AmazonBedrockExecutionRoleForKnowledgeBase_072pr, AmazonBedrockExecutionRoleForKnowledgeBase_byjin, AmazonBedrockExecutionRoleForKnowledgeBase_h9718...</p></div>
+                        <div><strong>Resolution</strong><p>Add IAM policy conditions to enforce guardrail usage:
 1. Use 'bedrock:GuardrailIdentifier' condition key
 2. Specify required guardrail ARN or ID
-3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1051,10 +1153,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1062,12 +1171,19 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption</td>
-            <td class="finding-details">S3 bucket 'nistairmfguardrail-invocationlogsbucket8fe5371b-wmlsng7pkyhm' for invocation logs uses SSE-S3 encryption instead of customer-managed KMS. Invocation logs may contain sensitive prompts and responses.</td>
-            <td class="resolution-text">1. Enable SSE-KMS with a customer-managed key on the S3 bucket
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>S3 bucket 'nistairmfguardrail-invocationlogsbucket8fe5371b-wmlsng7pkyhm' for invocation logs uses SSE-S3 encryption instead of customer-managed KMS. Invocation logs may contain sensitive prompts and responses.</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable SSE-KMS with a customer-managed key on the S3 bucket
 2. Update bucket policy to require encrypted uploads
-3. Consider enabling S3 bucket versioning and MFA delete for log integrity</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Consider enabling S3 bucket versioning and MFA delete for log integrity</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1075,10 +1191,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1086,10 +1209,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Run assessment in management account to check cross-account guardrails enforcement</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Cross-Account Guardrails Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Check must run in AWS Organizations management account to evaluate organizational policies</p></div>
+                        <div><strong>Resolution</strong><p>Run assessment in management account to check cross-account guardrails enforcement</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1097,10 +1227,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) is using the 'CLASSIC' content-filter tier instead of 'STANDARD'. The STANDARD tier provides more robust content filtering and broader language support than the CLASSIC tier.</td>
-            <td class="resolution-text">Update the guardrail to use the STANDARD content-filter tier for improved contextual understanding, better prompt attack filtering (distinguishing jailbreaks from prompt injection), and broader language support. The STANDARD tier requires cross-Region inference. Review pricing implications before upgrading.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) is using the 'CLASSIC' content-filter tier instead of 'STANDARD'. The STANDARD tier provides more robust content filtering and broader language support than the CLASSIC tier.</p></div>
+                        <div><strong>Resolution</strong><p>Update the guardrail to use the STANDARD content-filter tier for improved contextual understanding, better prompt attack filtering (distinguishing jailbreaks from prompt injection), and broader language support. The STANDARD tier requires cross-Region inference. Review pricing implications before upgrading.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1108,10 +1245,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1119,10 +1263,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</p></div>
+                        <div><strong>Resolution</strong><p>Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1130,10 +1281,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1141,13 +1299,20 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
 2. For Amazon RDS/Aurora: verify KMS encryption on the database
 3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1155,13 +1320,20 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
 2. For Amazon RDS/Aurora: verify KMS encryption on the database
 3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1169,13 +1341,20 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
 2. For Amazon RDS/Aurora: verify KMS encryption on the database
 3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1183,10 +1362,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1194,10 +1380,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">11 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>11 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</p></div>
+                        <div><strong>Resolution</strong><p>Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1205,10 +1398,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">1 guardrails have complete content filter coverage (hate, insults, sexual, violence)</td>
-            <td class="resolution-text">No action required. Continue monitoring filter effectiveness and adjust thresholds as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>1 guardrails have complete content filter coverage (hate, insults, sexual, violence)</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue monitoring filter effectiveness and adjust thresholds as needed.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1216,10 +1416,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure Automated Reasoning policies on guardrails to mathematically verify model responses. Define policies that specify allowed and disallowed behaviors. Use for high-assurance use cases where formal verification is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</p></div>
+                        <div><strong>Resolution</strong><p>Configure Automated Reasoning policies on guardrails to mathematically verify model responses. Define policies that specify allowed and disallowed behaviors. Use for high-assurance use cases where formal verification is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1227,10 +1434,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1238,10 +1452,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1249,10 +1470,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1260,10 +1488,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">1 guardrails have sensitive-information (PII) filters configured</td>
-            <td class="resolution-text">No action required. Periodically review the PII entity types and regex patterns to ensure coverage matches your data.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>1 guardrails have sensitive-information (PII) filters configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Periodically review the PII entity types and regex patterns to ensure coverage matches your data.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1271,10 +1506,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">1 guardrails have contextual grounding checks enabled</td>
-            <td class="resolution-text">No action required. Review grounding and relevance thresholds periodically to balance hallucination detection against false positives.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>1 guardrails have contextual grounding checks enabled</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Review grounding and relevance thresholds periodically to balance hallucination detection against false positives.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1282,10 +1524,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1293,10 +1542,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1304,10 +1560,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1315,10 +1578,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1326,10 +1596,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1337,10 +1614,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is properly configured with delivery to: Amazon S3, CloudWatch Logs</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is properly configured with delivery to: Amazon S3, CloudWatch Logs</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1348,10 +1632,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1359,10 +1650,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
             <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Guardrail Enforcement Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</p></div>
+                        <div><strong>Resolution</strong><p>Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1370,10 +1668,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1381,10 +1686,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1392,10 +1704,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1403,10 +1722,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 11 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 11 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1414,10 +1740,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: 1 guardrails have complete content filter coverage (hate, insults, sexual, violence)</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: 1 guardrails have complete content filter coverage (hate, insults, sexual, violence)</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1425,10 +1758,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -1436,10 +1776,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: 1 guardrails have sensitive-information (PII) filters configured</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: 1 guardrails have sensitive-information (PII) filters configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1447,10 +1794,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: 1 guardrails have contextual grounding checks enabled</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: 1 guardrails have contextual grounding checks enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -1458,10 +1812,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1469,10 +1830,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -1480,3265 +1848,5301 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AWS Shield Advanced Not Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</p></div>
+                        <div><strong>Resolution</strong><p>1. Subscribe to AWS Shield Advanced for DDoS protection.
+2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
+3. Enable Shield Response Team (SRT) access and configure proactive engagement.
+4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AWS Shield Advanced Not Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</p></div>
+                        <div><strong>Resolution</strong><p>1. Subscribe to AWS Shield Advanced for DDoS protection.
+2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
+3. Enable Shield Response Team (SRT) access and configure proactive engagement.
+4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Regional WAF Web ACLs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
+2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
+3. Add AWS Managed Rules for known bad inputs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Regional WAF Web ACLs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
+2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
+3. Add AWS Managed Rules for known bad inputs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">API Gateway Usage Plans Missing Throttle</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Usage plans without throttling: myAskMeAnything-UsagePlan. Unbounded API calls can exhaust Bedrock token quotas and inflate costs.</p></div>
+                        <div><strong>Resolution</strong><p>Set rateLimit and burstLimit on all usage plans associated with GenAI API stages. Consider per-consumer API keys with individual quotas.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">API Gateway Usage Plans Missing Throttle</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Usage plans without throttling: myAskMeAnything-UsagePlan. Unbounded API calls can exhaust Bedrock token quotas and inflate costs.</p></div>
+                        <div><strong>Resolution</strong><p>Set rateLimit and burstLimit on all usage plans associated with GenAI API stages. Consider per-consumer API keys with individual quotas.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Token Quotas Customized</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Periodically re-review quotas against expected peak load.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Token Quotas Customized</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Periodically re-review quotas against expected peak load.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Cost Anomaly Detection Monitors</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
+2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
+3. Set daily spend budgets with AWS Budgets as a secondary control.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Cost Anomaly Detection Monitors</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
+2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
+3. Set daily spend budgets with AWS Budgets as a secondary control.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock CloudWatch Alarms Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms for:
+- AWS/Bedrock InvocationThrottles (threshold > 0)
+- AWS/Bedrock TokensProcessed (threshold based on quota)
+- Custom application-level token counters via EMF</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock CloudWatch Alarms Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms for:
+- AWS/Bedrock InvocationThrottles (threshold > 0)
+- AWS/Bedrock TokensProcessed (threshold based on quota)
+- Custom application-level token counters via EMF</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No AI/ML Service Budgets Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
+2. Add SNS notifications to on-call channels.
+3. Consider budget actions to apply IAM deny policies when thresholds are breached.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No AI/ML Service Budgets Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
+2. Add SNS notifications to on-call channels.
+3. Consider budget actions to apply IAM deny policies when thresholds are breached.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Boundary Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Boundary Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtimes Missing Policy Engine</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtimes without authorizer configuration: origami_expeditions, neoCyan_Agent, customer_support_agent, cdk_agent_core, awsapimcpserver. Without a policy engine, agents can invoke any registered tool without authorization checks.</p></div>
+                        <div><strong>Resolution</strong><p>Configure an authorizer (Lambda or Cedar policy store) on each AgentCore runtime to enforce fine-grained tool-call authorization.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtimes Missing Policy Engine</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtimes without authorizer configuration: origami_expeditions, neoCyan_Agent, customer_support_agent, cdk_agent_core, awsapimcpserver. Without a policy engine, agents can invoke any registered tool without authorization checks.</p></div>
+                        <div><strong>Resolution</strong><p>Configure an authorizer (Lambda or Cedar policy store) on each AgentCore runtime to enforce fine-grained tool-call authorization.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Lambda Functions Without Concurrency Limits</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-111122223333-FinServAssessment, resco-aiml-IAMPermissionCaching, aiml-security-aiml-security-111122223333-SagemakerAssessment, resco-aiml-CleanupBucket, aiml-security-aiml-security-111122223333-BedrockAssessment, resco-aiml-BedrockAssessment, aiml-security-aiml-security-111122223333-CleanupBucket, aiml-security-aiml-security-111122223333-AgentCoreAssessment, e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Unlimited concurrency allows runaway agent loops to exhaust account limits.</p></div>
+                        <div><strong>Resolution</strong><p>1. Set reserved concurrency on agent Lambda functions.
+2. Implement maximum iteration counts in agent orchestration logic.
+3. Use Step Functions with MaxConcurrency and timeout states.
+4. Add circuit-breaker patterns to agent tool invocations.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Lambda Functions Without Concurrency Limits</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-111122223333-FinServAssessment, resco-aiml-IAMPermissionCaching, aiml-security-aiml-security-111122223333-SagemakerAssessment, resco-aiml-CleanupBucket, aiml-security-aiml-security-111122223333-BedrockAssessment, resco-aiml-BedrockAssessment, aiml-security-aiml-security-111122223333-CleanupBucket, aiml-security-aiml-security-111122223333-AgentCoreAssessment, e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Unlimited concurrency allows runaway agent loops to exhaust account limits.</p></div>
+                        <div><strong>Resolution</strong><p>1. Set reserved concurrency on agent Lambda functions.
+2. Implement maximum iteration counts in agent orchestration logic.
+3. Use Step Functions with MaxConcurrency and timeout states.
+4. Add circuit-breaker patterns to agent tool invocations.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Agent Rate Alarms Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms on:
+- Bedrock agent invocation counts (threshold based on expected max)
+- Lambda invocation errors for agent functions
+- Step Functions execution failures and timeouts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Agent Rate Alarms Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms on:
+- Bedrock agent invocation counts (threshold based on expected max)
+- Lambda invocation errors for agent functions
+- Step Functions execution failures and timeouts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock-Scoped SCPs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
+2. Use bedrock:ModelId condition key to allowlist approved models.
+3. Maintain a model inventory and update the SCP when models are approved/retired.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock-Scoped SCPs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
+2. Use bedrock:ModelId condition key to allowlist approved models.
+3. Maintain a model inventory and update the SCP when models are approved/retired.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Provenance Tags Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All reviewed models have required provenance tags.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Provenance Tags Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All reviewed models have required provenance tags.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Governance Config Rules Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 11 model-related Config rule(s).</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Governance Config Rules Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 11 model-related Config rule(s).</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock Evaluation Jobs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
+2. Use FMEval library for automated robustness testing.
+3. Schedule periodic re-evaluation after model updates.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock Evaluation Jobs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
+2. Use FMEval library for automated robustness testing.
+3. Schedule periodic re-evaluation after model updates.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ECR Repositories Without Image Scanning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>4 ECR repo(s) without scan-on-push: mlexplorationrepo, cdk-hnb659fds-container-assets-111122223333-us-east-1, bedrock-agentcore-customer_support_agent, bedrock-agentcore-origami_expeditions.</p></div>
+                        <div><strong>Resolution</strong><p>Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ECR Repositories Without Image Scanning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>4 ECR repo(s) without scan-on-push: mlexplorationrepo, cdk-hnb659fds-container-assets-111122223333-us-east-1, bedrock-agentcore-customer_support_agent, bedrock-agentcore-origami_expeditions.</p></div>
+                        <div><strong>Resolution</strong><p>Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Feature Groups Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Feature Store groups found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Feature Groups Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Feature Store groups found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Training Data Buckets Without Versioning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>13 training data bucket(s) without versioning: ancbedrocklogging, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, fsi-genai-workshop-bedrock-datasources-111122223333-us-west-2, knowledgebase-bedrock-agent-agasthik, llmevaluationpromptfoo-bedrockkb-cozhbzbrcmd2, sagemaker-studio-111122223333-huo1mvme4t.</p></div>
+                        <div><strong>Resolution</strong><p>Enable S3 versioning on all training data buckets. Consider enabling MFA Delete for additional protection against poisoning.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Training Data Buckets Without Versioning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>13 training data bucket(s) without versioning: ancbedrocklogging, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, fsi-genai-workshop-bedrock-datasources-111122223333-us-west-2, knowledgebase-bedrock-agent-agasthik, llmevaluationpromptfoo-bedrockkb-cozhbzbrcmd2, sagemaker-studio-111122223333-huo1mvme4t.</p></div>
+                        <div><strong>Resolution</strong><p>Enable S3 versioning on all training data buckets. Consider enabling MFA Delete for additional protection against poisoning.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Overly Permissive Knowledge Base IAM Roles</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>827 role(s) with wildcard KB permissions:
+- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateKnowledgeBase' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateDataSource' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'Admin' allows '*'
+- Role 'agentcore-wildrydes_gateway_role_ab3991f6-role' allows 'bedrock:*'
+- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'Agentic-AI-MCP-Strands-SDK-Works-VSCodeInstanceRole-NCTUnlnRBFO6' allows '*'
+- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)</p></div>
+                        <div><strong>Resolution</strong><p>Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Overly Permissive Knowledge Base IAM Roles</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>827 role(s) with wildcard KB permissions:
+- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateKnowledgeBase' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateDataSource' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'Admin' allows '*'
+- Role 'agentcore-wildrydes_gateway_role_ab3991f6-role' allows 'bedrock:*'
+- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'Agentic-AI-MCP-Strands-SDK-Works-VSCodeInstanceRole-NCTUnlnRBFO6' allows '*'
+- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)</p></div>
+                        <div><strong>Resolution</strong><p>Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add metadata fields (tenantId, dataClassification) to KB data sources.
+2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
+3. Validate filters in integration tests to prevent cross-tenant data leakage.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add metadata fields (tenantId, dataClassification) to KB data sources.
+2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
+3. Validate filters in integration tests to prevent cross-tenant data leakage.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">OpenSearch Serverless Encryption Policies Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 5 encryption policy(ies); 5 use a customer-managed KMS key.</p></div>
+                        <div><strong>Resolution</strong><p>Verify all vector store collections use customer-managed KMS keys.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity not used</td>
-            <td class="finding-details">No Bedrock service VPC endpoints found in VPCs: vpc-0f85a6754ab37efb7, vpc-5c3b6524, vpc-03bcafcb58a3029fc</td>
-            <td class="resolution-text">Create a VPC endpoint in your VPC with any of the following Bedrock service endpoints that your application may be using:
-- com.amazonaws.region.bedrock
-- com.amazonaws.region.bedrock-runtime
-- com.amazonaws.region.bedrock-agent
-- com.amazonaws.region.bedrock-agent-runtime</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>FS-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">OpenSearch Serverless Encryption Policies Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 5 encryption policy(ies); 5 use a customer-managed KMS key.</p></div>
+                        <div><strong>Resolution</strong><p>Verify all vector store collections use customer-managed KMS keys.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 5 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable model invocation logging to collect invocation logs, model input data, and model output data. Configure logging to deliver to Amazon S3, CloudWatch Logs, or both for comprehensive monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>FS-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 5 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">Amazon Bedrock Guardrails are properly configured with 1 guardrails</td>
-            <td class="resolution-text">No action required. Continue monitoring and updating guardrails as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Contextual Grounding Enabled on Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with contextual grounding: nist-ai-rmf-guardrail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required for contextual grounding. Also consider enabling Automated Reasoning checks for formal policy verification.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">No action required. Continue monitoring CloudTrail logs for Bedrock activity.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>FS-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Contextual Grounding Enabled on Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with contextual grounding: nist-ai-rmf-guardrail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required for contextual grounding. Also consider enabling Automated Reasoning checks for formal policy verification.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Automated Reasoning Policies Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</p></div>
+                        <div><strong>Resolution</strong><p>1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
+2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
+3. Set confidenceThreshold on the policy to control strictness.
+4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
+5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>FS-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Automated Reasoning Policies Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</p></div>
+                        <div><strong>Resolution</strong><p>1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
+2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
+3. Set confidenceThreshold on the policy to control strictness.
+4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
+5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-bedrock-agent' (XSPYLN4FQL) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Denied Topics Configured on CLASSIC Tier</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides broader language support and improved detection for denied topics.</p></div>
+                        <div><strong>Resolution</strong><p>Verify topics cover regulated financial advice categories. For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (set topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile on the guardrail). When authoring denied-topic policies, use existing compliance materials as the source: employee policies, training materials, procedure documents, and incident reports (PDF §1.2.1 Practical guidance).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (SUGAG7RGYD) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>FS-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Denied Topics Configured on CLASSIC Tier</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides broader language support and improved detection for denied topics.</p></div>
+                        <div><strong>Resolution</strong><p>Verify topics cover regulated financial advice categories. For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (set topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile on the guardrail). When authoring denied-topic policies, use existing compliance materials as the source: employee policies, training materials, procedure documents, and incident reports (PDF §1.2.1 Practical guidance).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'promptfoo-rag-workshop-111122223333-kb' (N74ZIKTUFL) uses 'RDS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement post-processing to append required disclaimers to GenAI outputs.
+2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
+3. Document disclaimer requirements in the AI use case register.
+4. Test disclaimer presence in QA/UAT before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'InvestmentResearchKB' (M1GMUG3BP0) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement post-processing to append required disclaimers to GenAI outputs.
+2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
+3. Document disclaimer requirements in the AI use case register.
+4. Test disclaimer presence in QA/UAT before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-quick-start-xtwwd' (ENFHSBBLMV) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation with compliance-specific datasets:
+- Fair lending test cases (ECOA, Fair Housing Act)
+- UDAP/UDAAP unfair/deceptive practice scenarios
+- AML/KYC edge cases</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'kb-s3-vector-store' (116IXQU5VP) uses 'S3_VECTORS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation with compliance-specific datasets:
+- Fair lending test cases (ECOA, Fair Housing Act)
+- UDAP/UDAAP unfair/deceptive practice scenarios
+- AML/KYC edge cases</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Missing</td>
-            <td class="finding-details">The following roles can invoke Bedrock models without enforced guardrails: 111122223333-us-east-1-kb-bedrock-service-role, agentcore-wildrydes_gateway_role_ab3991f6-role, AgentCoreEvalsSDK-us-east-1-d04ba7b68b, AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76, AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b, AmazonBedrockExecutionRoleForAgents_S0T9VNPP9D, AmazonBedrockExecutionRoleForAgents_WNCOPE29NZ, AmazonBedrockExecutionRoleForKnowledgeBase_072pr, AmazonBedrockExecutionRoleForKnowledgeBase_byjin, AmazonBedrockExecutionRoleForKnowledgeBase_h9718...</td>
-            <td class="resolution-text">Add IAM policy conditions to enforce guardrail usage:
-1. Use 'bedrock:GuardrailIdentifier' condition key
-2. Specify required guardrail ARN or ID
-3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Data Sources Past Review Threshold</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>2 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
+- KB 'knowledge-base-semiconductors' source 'knowledge-base-quick-start-qpvuv-data-source' last synced 722 days ago
+- KB '111122223333-us-east-1-kb' source '111122223333-us-east-1-kb-datasource' last synced 200 days ago
+Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</p></div>
+                        <div><strong>Resolution</strong><p>1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
+2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
+3. Set CloudWatch alarms on sync job failures.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>FS-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Data Sources Past Review Threshold</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>2 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
+- KB 'knowledge-base-semiconductors' source 'knowledge-base-quick-start-qpvuv-data-source' last synced 722 days ago
+- KB '111122223333-us-east-1-kb' source '111122223333-us-east-1-kb-datasource' last synced 200 days ago
+Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</p></div>
+                        <div><strong>Resolution</strong><p>1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
+2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
+3. Set CloudWatch alarms on sync job failures.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Source Attribution — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use Bedrock RetrieveAndGenerate with citations enabled.
+2. Include source document references in response post-processing.
+3. Test citation accuracy in QA before production deployment.
+4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Source Attribution — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use Bedrock RetrieveAndGenerate with citations enabled.
+2. Include source document references in response post-processing.
+3. Test citation accuracy in QA before production deployment.
+4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is using the 'CLASSIC' content-filter tier instead of 'STANDARD'. The STANDARD tier provides more robust content filtering and broader language support than the CLASSIC tier.</td>
-            <td class="resolution-text">Update the guardrail to use the STANDARD content-filter tier for improved contextual understanding, better prompt attack filtering (distinguishing jailbreaks from prompt injection), and broader language support. The STANDARD tier requires cross-Region inference. Review pricing implications before upgrading.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-33</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">KB Data Source Buckets Without Versioning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>KB data source S3 buckets without versioning: 111122223333-us-east-1-kb-data-bucket.</p></div>
+                        <div><strong>Resolution</strong><p>Enable S3 versioning on all KB data source buckets. Enable S3 Object Integrity (checksum) for tamper detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-33</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">KB Data Source Buckets Without Versioning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>KB data source S3 buckets without versioning: 111122223333-us-east-1-kb-data-bucket.</p></div>
+                        <div><strong>Resolution</strong><p>Enable S3 versioning on all KB data source buckets. Enable S3 Object Integrity (checksum) for tamper detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-34</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Legacy Foundation Models Available in Region</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</p></div>
+                        <div><strong>Resolution</strong><p>1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
+2. Migrate active usage to current model versions.
+3. Document training-data cutoff dates for all models in use.
+4. Add data-currency disclaimers to outputs from models with old cutoffs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-34</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Legacy Foundation Models Available in Region</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</p></div>
+                        <div><strong>Resolution</strong><p>1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
+2. Migrate active usage to current model versions.
+3. Document training-data cutoff dates for all models in use.
+4. Add data-currency disclaimers to outputs from models with old cutoffs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-35</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation or FMEval with harmful content datasets:
+- Toxicity detection
+- Hate speech classification
+- Violence/self-harm content</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) uses 'RDS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-35</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation or FMEval with harmful content datasets:
+- Toxicity detection
+- Hate speech classification
+- Violence/self-harm content</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-36</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filters on CLASSIC Tier</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with content filters: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides improved contextual understanding, typographical error detection, 60+ language support, and better prompt-attack classification (distinguishes jailbreaks from prompt injection).</p></div>
+                        <div><strong>Resolution</strong><p>Consider upgrading to STANDARD tier content filters for FinServ workloads that handle multiple languages or require higher detection accuracy. STANDARD tier requires cross-region inference (crossRegionDetails.guardrailProfileArn on the guardrail). To upgrade: update the guardrail's contentPolicy.filtersConfig.contentFiltersTierConfig with tierName=STANDARD and configure a guardrail cross-region profile.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>FS-36</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filters on CLASSIC Tier</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with content filters: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides improved contextual understanding, typographical error detection, 60+ language support, and better prompt-attack classification (distinguishes jailbreaks from prompt injection).</p></div>
+                        <div><strong>Resolution</strong><p>Consider upgrading to STANDARD tier content filters for FinServ workloads that handle multiple languages or require higher detection accuracy. STANDARD tier requires cross-region inference (crossRegionDetails.guardrailProfileArn on the guardrail). To upgrade: update the guardrail's contentPolicy.filtersConfig.contentFiltersTierConfig with tierName=STANDARD and configure a guardrail cross-region profile.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-37</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
+2. Route flagged outputs to human reviewers via SQS/SNS.
+3. Log feedback to DynamoDB/S3 for model improvement.
+4. Define SLAs for reviewing flagged content.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>FS-37</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
+2. Route flagged outputs to human reviewers via SQS/SNS.
+3. Log feedback to DynamoDB/S3 for model improvement.
+4. Define SLAs for reviewing flagged content.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">7 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is missing content filters: HATE, VIOLENCE, SEXUAL, INSULTS. Complete content filter coverage is essential for comprehensive content safety.</td>
-            <td class="resolution-text">Update guardrail to enable all content filters (HATE, INSULTS, SEXUAL, VIOLENCE). Configure appropriate threshold levels (LOW, MEDIUM, HIGH) for both input and output filtering based on your use case. Review AWS documentation for threshold guidance.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure Automated Reasoning policies on guardrails to mathematically verify model responses. Define policies that specify allowed and disallowed behaviors. Use for high-assurance use cases where formal verification is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-38</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Guardrails With Word Filters</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 guardrail(s) but none have word/phrase filters. Profanity and prohibited financial terms may appear in outputs.</p></div>
+                        <div><strong>Resolution</strong><p>Add word filters to guardrails:
+- Enable AWS managed profanity list
+- Add custom denylist for prohibited financial terms
+- Add allowlist for required regulatory language</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>FS-38</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Guardrails With Word Filters</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 guardrail(s) but none have word/phrase filters. Profanity and prohibited financial terms may appear in outputs.</p></div>
+                        <div><strong>Resolution</strong><p>Add word filters to guardrails:
+- Enable AWS managed profanity list
+- Add custom denylist for prohibited financial terms
+- Add allowlist for required regulatory language</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-39</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Clarify Bias Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
+2. Define protected attributes (age, gender, race proxies).
+3. Set bias metric thresholds and alert on violations.
+4. Document bias testing results for regulatory examination.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>FS-39</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Clarify Bias Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
+2. Define protected attributes (age, gender, race proxies).
+3. Set bias metric thresholds and alert on violations.
+4. Document bias testing results for regulatory examination.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-40</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation with bias test datasets:
+- Demographic parity test cases
+- Equal opportunity scenarios
+- Counterfactual fairness tests</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>FS-40</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation with bias test datasets:
+- Demographic parity test cases
+- Equal opportunity scenarios
+- Counterfactual fairness tests</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-41</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Clarify Explainability Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure SageMaker Clarify explainability for credit/lending models.
+2. Generate SHAP values for feature importance.
+3. Map top features to human-readable adverse action reason codes.
+4. Store explanations for regulatory examination.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) has no sensitive-information filters configured (no PII entities or regex patterns). Prompts and model responses are not screened for sensitive data such as PII.</td>
-            <td class="resolution-text">Configure sensitive-information filters on the guardrail: add PII entity types (e.g. NAME, EMAIL, SSN, CREDIT_DEBIT_CARD_NUMBER) and/or custom regex patterns, and set the appropriate BLOCK or ANONYMIZE action for input and output.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-41</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Clarify Explainability Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure SageMaker Clarify explainability for credit/lending models.
+2. Generate SHAP values for feature importance.
+3. Map top features to human-readable adverse action reason codes.
+4. Store explanations for regulatory examination.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.</td>
-            <td class="resolution-text">Enable contextual grounding checks (GROUNDING and RELEVANCE filter types) on the guardrail with appropriate thresholds. This is especially important for RAG applications to ensure responses are grounded in the retrieved source material.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-42</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Model Cards Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create SageMaker Model Cards for all production models.
+2. Document: intended use, out-of-scope uses, training data, bias evaluations.
+3. Include regulatory compliance attestations.
+4. Review and update cards at each model version release.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-42</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Model Cards Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create SageMaker Model Cards for all production models.
+2. Document: intended use, out-of-scope uses, training data, bias evaluations.
+3. Include regulatory compliance attestations.
+4. Review and update cards at each model version release.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-43</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No CloudWatch Logs Data Protection Policies</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create CloudWatch Logs data protection policies to mask PII.
+2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
+3. Apply policies to Bedrock invocation log groups.
+4. Test masking with synthetic PII before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>FS-43</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No CloudWatch Logs Data Protection Policies</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create CloudWatch Logs data protection policies to mask PII.
+2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
+3. Apply policies to Bedrock invocation log groups.
+4. Test masking with synthetic PII before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-44</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Macie Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon Macie is enabled and scanning S3 buckets.</p></div>
+                        <div><strong>Resolution</strong><p>Verify Macie jobs cover training data and KB data source buckets.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>FS-44</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Macie Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon Macie is enabled and scanning S3 buckets.</p></div>
+                        <div><strong>Resolution</strong><p>Verify Macie jobs cover training data and KB data source buckets.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-45</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail PII Filters Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with PII filters: nist-ai-rmf-guardrail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-45</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail PII Filters Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with PII filters: nist-ai-rmf-guardrail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-46</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AI/ML Buckets Without Data Classification Tags</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>18 AI/ML bucket(s) without data-classification tags: 111122223333-us-east-1-kb-data-bucket, ancbedrocklogging, ancknowledgebase, aws-streaming-data-solut-outputaccesslogsbucket8b-1o7m0kb4bafm4, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, create-customer-resources-kb-bucket-111122223333.</p></div>
+                        <div><strong>Resolution</strong><p>Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-46</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AI/ML Buckets Without Data Classification Tags</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>18 AI/ML bucket(s) without data-classification tags: 111122223333-us-east-1-kb-data-bucket, ancbedrocklogging, ancknowledgebase, aws-streaming-data-solut-outputaccesslogsbucket8b-1o7m0kb4bafm4, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, create-customer-resources-kb-bucket-111122223333.</p></div>
+                        <div><strong>Resolution</strong><p>Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-47</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Grounding Thresholds Appropriate</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All 1 guardrail(s) with a GROUNDING filter have thresholds ≥0.7.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-47</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Grounding Thresholds Appropriate</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All 1 guardrail(s) with a GROUNDING filter have thresholds ≥0.7.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-48</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Active Knowledge Bases for RAG Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 active Knowledge Base(s) for RAG grounding.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-48</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Active Knowledge Bases for RAG Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 active Knowledge Base(s) for RAG grounding.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-49</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
+2. Implement post-processing to append disclaimers.
+3. Test disclaimer presence in QA before production.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-49</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
+2. Implement post-processing to append disclaimers.
+3. Test disclaimer presence in QA before production.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 7 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-50</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Relevance Grounding Filters Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with RELEVANCE grounding filters: nist-ai-rmf-guardrail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is missing content filters: HATE, VIOLENCE, SEXUAL, INSULTS. Complete content filter coverage is essential for comprehensive content safety.</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>FS-50</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Relevance Grounding Filters Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with RELEVANCE grounding filters: nist-ai-rmf-guardrail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-51</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Guardrails With Prompt Attack Filters</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 guardrail(s) but none have PROMPT_ATTACK filters. Prompt injection attacks may bypass system prompts and access controls.</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable PROMPT_ATTACK content filter in Bedrock Guardrails.
+2. Set input filter strength to HIGH.
+3. Use input tags (<amazon-bedrock-guardrails-guardContent_xyz>) to differentiate user inputs from developer-provided prompts — required for PROMPT_ATTACK filters to work correctly with InvokeModel/InvokeModelWithResponseStream.
+4. Consider STANDARD tier (GA June 2025) for better jailbreak vs. injection classification and broader language support.
+5. Implement application-level input sanitization as defense-in-depth.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-prompt-attack.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) has no sensitive-information filters configured (no PII entities or regex patterns). Prompts and model responses are not screened for sensitive data such as PII.</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-51</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Guardrails With Prompt Attack Filters</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 guardrail(s) but none have PROMPT_ATTACK filters. Prompt injection attacks may bypass system prompts and access controls.</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable PROMPT_ATTACK content filter in Bedrock Guardrails.
+2. Set input filter strength to HIGH.
+3. Use input tags (<amazon-bedrock-guardrails-guardContent_xyz>) to differentiate user inputs from developer-provided prompts — required for PROMPT_ATTACK filters to work correctly with InvokeModel/InvokeModelWithResponseStream.
+4. Consider STANDARD tier (GA June 2025) for better jailbreak vs. injection classification and broader language support.
+5. Implement application-level input sanitization as defense-in-depth.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-prompt-attack.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-52</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Lambda Functions on Deprecated Runtimes</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Functions on deprecated runtimes: e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Deprecated runtimes may use outdated boto3/SDK versions lacking security patches.</p></div>
+                        <div><strong>Resolution</strong><p>1. Upgrade Lambda functions to a supported runtime — Python 3.12+, Node.js 22.x or 24.x, Java 21+, or .NET 8+.
+2. Update boto3 to the latest version in Lambda layers (pin the version in requirements.txt and redeploy).
+3. Enable Lambda runtime management controls for automatic minor-version updates (runtimeManagementConfig.updateRuntimeOn = 'Auto').
+4. Refer to https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html for the authoritative list of supported and deprecated runtimes.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>FS-52</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Lambda Functions on Deprecated Runtimes</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Functions on deprecated runtimes: e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Deprecated runtimes may use outdated boto3/SDK versions lacking security patches.</p></div>
+                        <div><strong>Resolution</strong><p>1. Upgrade Lambda functions to a supported runtime — Python 3.12+, Node.js 22.x or 24.x, Java 21+, or .NET 8+.
+2. Update boto3 to the latest version in Lambda layers (pin the version in requirements.txt and redeploy).
+3. Enable Lambda runtime management controls for automatic minor-version updates (runtimeManagementConfig.updateRuntimeOn = 'Auto').
+4. Refer to https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html for the authoritative list of supported and deprecated runtimes.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-53</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional WAF Web ACLs found.</p></div>
+                        <div><strong>Resolution</strong><p>Create WAF Web ACLs with injection protection rules (see FS-01).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-53</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional WAF Web ACLs found.</p></div>
+                        <div><strong>Resolution</strong><p>Create WAF Web ACLs with injection protection rules (see FS-01).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-54</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</p></div>
+                        <div><strong>Resolution</strong><p>1. Conduct penetration testing of GenAI applications at least annually and before major releases.
+2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
+3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
+4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
+5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-54</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</p></div>
+                        <div><strong>Resolution</strong><p>1. Conduct penetration testing of GenAI applications at least annually and before major releases.
+2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
+3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
+4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
+5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-55</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Output Validation Functions Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement output validation Lambda functions in GenAI pipelines.
+2. Validate output schema, length, and content before downstream use.
+3. Sanitize outputs before rendering in web UIs (XSS prevention).
+4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-55</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Output Validation Functions Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement output validation Lambda functions in GenAI pipelines.
+2. Validate output schema, length, and content before downstream use.
+3. Sanitize outputs before rendering in web UIs (XSS prevention).
+4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-56</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional WAF Web ACLs found.</p></div>
+                        <div><strong>Resolution</strong><p>Create WAF ACLs with XSS prevention rules.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-56</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional WAF Web ACLs found.</p></div>
+                        <div><strong>Resolution</strong><p>Create WAF ACLs with XSS prevention rules.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-57</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Output Encoding — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Output encoding practices cannot be verified via AWS APIs. Manual code review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. HTML-encode GenAI outputs before rendering in web UIs.
+2. Use parameterized queries when GenAI output is used in database operations.
+3. JSON-encode outputs before embedding in JavaScript contexts.
+4. Validate output length and format before passing to downstream APIs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-57</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Output Encoding — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Output encoding practices cannot be verified via AWS APIs. Manual code review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. HTML-encode GenAI outputs before rendering in web UIs.
+2. Use parameterized queries when GenAI output is used in database operations.
+3. JSON-encode outputs before embedding in JavaScript contexts.
+4. Validate output length and format before passing to downstream APIs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-58</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use Bedrock structured output (response schemas) where supported.
+2. Implement JSON schema validation on Lambda output processors.
+3. Reject malformed outputs and return safe error responses.
+4. Log schema validation failures to CloudWatch for monitoring.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-58</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use Bedrock structured output (response schemas) where supported.
+2. Implement JSON schema validation on Lambda output processors.
+3. Reject malformed outputs and return safe error responses.
+4. Log schema validation failures to CloudWatch for monitoring.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-59</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Topic Restrictions Configured on CLASSIC Tier</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only; the STANDARD tier (GA June 2025) adds broader language support for off-topic detection.</p></div>
+                        <div><strong>Resolution</strong><p>For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-59</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Topic Restrictions Configured on CLASSIC Tier</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only; the STANDARD tier (GA June 2025) adds broader language support for off-topic detection.</p></div>
+                        <div><strong>Resolution</strong><p>For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-60</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</p></div>
+                        <div><strong>Resolution</strong><p>1. Include explicit scope instructions in system prompts.
+2. Use Bedrock Guardrails relevance grounding filter.
+3. Test with off-topic prompts in QA to verify rejection behavior.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-60</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</p></div>
+                        <div><strong>Resolution</strong><p>1. Include explicit scope instructions in system prompts.
+2. Use Bedrock Guardrails relevance grounding filter.
+3. Test with off-topic prompts in QA to verify rejection behavior.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-61</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Automated KB Sync Schedules Detected</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
+2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
+3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
+4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-61</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No Automated KB Sync Schedules Detected</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
+2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
+3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
+4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-62</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
+2. Expose KB last sync timestamp in application responses.
+3. Alert users when KB data is older than defined threshold.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-62</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
+2. Expose KB last sync timestamp in application responses.
+3. Alert users when KB data is older than defined threshold.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-63</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Foundation Model Lifecycle Management</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No legacy models detected. 10 lifecycle-related Config rule(s) found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-63</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Foundation Model Lifecycle Management</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No legacy models detected. 10 lifecycle-related Config rule(s) found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-65</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
+- semiconductor-demo-9999
+- 111122223333-us-east-1-kb-data-bucket</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
+2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
+3. Integrate alerts into your security incident response workflow.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-65</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
+- semiconductor-demo-9999
+- 111122223333-us-east-1-kb-data-bucket</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
+2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
+3. Integrate alerts into your security incident response workflow.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-66</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtimes Missing End-User Identity Propagation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following runtimes have no JWT or IAM authorizer configured for end-user identity propagation. Tool calls are authorized only by the agent execution role, not the originating user:
+- origami_expeditions
+- neoCyan_Agent
+- customer_support_agent
+- cdk_agent_core
+- awsapimcpserver</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure a custom JWT authorizer or IAM authorizer on each AgentCore runtime.
+2. Propagate the end-user's identity token to downstream tool services.
+3. Ensure tool services validate the propagated identity before executing actions.
+4. Do not expose propagated identity tokens to unauthorized third parties.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-66</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtimes Missing End-User Identity Propagation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following runtimes have no JWT or IAM authorizer configured for end-user identity propagation. Tool calls are authorized only by the agent execution role, not the originating user:
+- origami_expeditions
+- neoCyan_Agent
+- customer_support_agent
+- cdk_agent_core
+- awsapimcpserver</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure a custom JWT authorizer or IAM authorizer on each AgentCore runtime.
+2. Propagate the end-user's identity token to downstream tool services.
+3. Ensure tool services validate the propagated identity before executing actions.
+4. Do not expose propagated identity tokens to unauthorized third parties.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-67</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
+- aiml-security-aiml-security-111122223333-FinServAssessment
+- aiml-security-aiml-security-111122223333-BedrockAssessment
+- resco-aiml-BedrockAssessment
+- aiml-security-aiml-security-111122223333-AgentCoreAssessment
+- e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk
+- e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII
+- resco-aiml-AgentCoreAssessment</p></div>
+                        <div><strong>Resolution</strong><p>1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
+2. Implement threshold enforcement logic in the Lambda handler.
+3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
+4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-67</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
+- aiml-security-aiml-security-111122223333-FinServAssessment
+- aiml-security-aiml-security-111122223333-BedrockAssessment
+- resco-aiml-BedrockAssessment
+- aiml-security-aiml-security-111122223333-AgentCoreAssessment
+- e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk
+- e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII
+- resco-aiml-AgentCoreAssessment</p></div>
+                        <div><strong>Resolution</strong><p>1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
+2. Implement threshold enforcement logic in the Lambda handler.
+3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
+4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-68</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">API Gateway Request Body Size Limits Not Enforced</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add a maxLength (or maxItems/maxProperties) bound to the request-body JSON-Schema model used by your request validator, so oversized prompts are rejected with a 400.
+2. Add a WAF SizeConstraintStatement on the request Body sized within WAF's body-inspection window (default 16 KB; raise via the web ACL AssociationConfig, or set OversizeHandling=MATCH to block bodies beyond the window), and associate the ACL with the API stage.
+3. Set the max_tokens parameter in Bedrock API calls to cap output length.
+4. Implement client-side token counting before submitting requests.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-68</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">API Gateway Request Body Size Limits Not Enforced</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add a maxLength (or maxItems/maxProperties) bound to the request-body JSON-Schema model used by your request validator, so oversized prompts are rejected with a 400.
+2. Add a WAF SizeConstraintStatement on the request Body sized within WAF's body-inspection window (default 16 KB; raise via the web ACL AssociationConfig, or set OversizeHandling=MATCH to block bodies beyond the window), and associate the ACL with the API stage.
+3. Set the max_tokens parameter in Bedrock API calls to cap output length.
+4. Implement client-side token counting before submitting requests.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-69</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Input Validation Functions Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 Lambda function(s) with input validation/sanitization naming patterns: resco-aiml-CleanupBucket, visa-bulletin-tracker-prod-cleanup, aiml-security-aiml-security-111122223333-CleanupBucket.</p></div>
+                        <div><strong>Resolution</strong><p>Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-69</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Input Validation Functions Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 3 Lambda function(s) with input validation/sanitization naming patterns: resco-aiml-CleanupBucket, visa-bulletin-tracker-prod-cleanup, aiml-security-aiml-security-111122223333-CleanupBucket.</p></div>
+                        <div><strong>Resolution</strong><p>Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+            <td><code>111122223333</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>FS-00</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
+1. Create and version your prompts
+2. Test different prompt variants
+3. Share prompts across your organization
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Full Access Policy</td>
-            <td class="finding-details">The following roles have BedrockAgentCoreFullAccess policy: AmazonSageMaker-ExecutionRole-20250525T153161</td>
-            <td class="resolution-text">Replace with least-privilege policies scoped to specific AgentCore resources and actions</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Wildcard Permissions</td>
-            <td class="finding-details">The following roles have wildcard AgentCore permissions on all resources: agentcore-wildrydes_gateway_role_ab3991f6-role</td>
-            <td class="resolution-text">Scope permissions to specific AgentCore resources using resource ARNs</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Stale Access</td>
-            <td class="finding-details">The following principals have not accessed AgentCore in 60+ days: role 'AmazonSageMaker-ExecutionRole-20250525T153161' (199 days), role 'AWSServiceRoleForBedrockAgentCoreRuntimeIdentity' (199 days), role 'CustomerSupportAssistantBedrockAgentCoreRole-us-east-1' (199 days), role 'resco-aiml-security-19304-AgentCoreSecurityAssessme-w773pPsFWNsn' (82 days)</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="Global">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'agentcore-wildrydes_gateway_role_ab3991f6-role', role 'AIMLSecurityMemberRole', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b', role 'aws-api-mcp-server-execution-role', role 'CloudSeerTrustedServiceRole', role 'CustomerSupportStackInfra-RuntimeAgentCoreRole-N188nLB5RtLO', role 'IDP-AnalyticsProcessorFunctionRole-H3gwkJtNqrqW'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</p></div>
+                        <div><strong>Resolution</strong><p>Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore ECR Repository AWS-Managed Keys</td>
-            <td class="finding-details">ECR repository 'bedrock-agentcore-customer_support_agent' uses AWS-managed keys instead of customer-managed KMS keys</td>
-            <td class="resolution-text">Consider using customer-managed KMS keys for better control and audit capabilities</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore ECR Repository AWS-Managed Keys</td>
-            <td class="finding-details">ECR repository 'bedrock-agentcore-origami_expeditions' uses AWS-managed keys instead of customer-managed KMS keys</td>
-            <td class="resolution-text">Consider using customer-managed KMS keys for better control and audit capabilities</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Encryption</td>
-            <td class="finding-details">Memory 'CustomerSupportMemory-x69jBq5GLp' (CustomerSupportMemory-x69jBq5GLp) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Enable encryption with customer-managed KMS keys</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Encryption</td>
-            <td class="finding-details">Memory 'cdk_agent_core_mem-uxfIagADuF' (cdk_agent_core_mem-uxfIagADuF) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Enable encryption with customer-managed KMS keys</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Encryption</td>
-            <td class="finding-details">Memory 'wildrydes_memory_ab3991f6-9FjiHOHjT2' (wildrydes_memory_ab3991f6-9FjiHOHjT2) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Enable encryption with customer-managed KMS keys</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">Found 2 Gateway resources</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Missing</td>
-            <td class="finding-details">No AgentCore VPC endpoints found in 4 VPCs. AgentCore API traffic traverses public internet, exposing it to interception.</td>
-            <td class="resolution-text">Create VPC interface endpoints for AgentCore services:
-1. com.amazonaws.region.bedrock-agentcore
-2. com.amazonaws.region.bedrock-agentcore-control
-3. com.amazonaws.region.bedrock-agentcore-runtime
-This enables private connectivity via AWS PrivateLink</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+            <td><code>111122223333</code></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonSageMaker-ExecutionRole-20231014T200029' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Missing</td>
-            <td class="finding-details">The following AgentCore resources do not have resource-based policies: Runtime 'origami_expeditions', Runtime 'neoCyan_Agent', Runtime 'customer_support_agent', Runtime 'cdk_agent_core', Runtime 'awsapimcpserver' and 2 more. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to:
-1. Implement defense-in-depth access control
-2. Enable cross-account access control
-3. Restrict access based on source VPC or IP
-4. Implement hierarchical authorization for Agent Runtimes</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonSageMaker-ExecutionRole-20250525T153161' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'AmazonSageMakerServiceCatalogProductsExecutionRole' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Missing</td>
-            <td class="finding-details">The following Gateways do not use customer-managed KMS encryption: 'customersupport-gw', 'wildrydes-gateway-ab3991f6'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">1. Create gateways with customer-managed KMS keys for additional control
-2. AWS-managed keys are single-tenant and region-specific
-3. Consider CMK for enhanced audit capabilities and key rotation control</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'EMR_EC2_DefaultRole' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) uses authorizerType CUSTOM_JWT.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</td>
-            <td class="resolution-text">Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) does not expose DEBUG-level exception detail.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'SageMaker-EMR-ExecutionRole' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection Missing</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) is not associated with an AWS WAF web ACL.</td>
-            <td class="resolution-text">Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Non-VPC Only Network Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-cz8qi7j81si3' (QuickSetupDomain-20250525T153160) is not configured for VPC-only access</p></div>
+                        <div><strong>Resolution</strong><p>Configure the SageMaker domain to use VPC-only network access type</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) uses authorizerType CUSTOM_JWT.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SSO Not Properly Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-cz8qi7j81si3' (QuickSetupDomain-20250525T153160) is using authentication mode: IAM</p></div>
+                        <div><strong>Resolution</strong><p>Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</td>
-            <td class="resolution-text">Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Missing Encryption Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Domain 'QuickSetupDomain-20250525T153160' - No KMS key configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure encryption using AWS KMS customer managed keys for enhanced security</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) does not expose DEBUG-level exception detail.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection Missing</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) is not associated with an AWS WAF web ACL.</td>
-            <td class="resolution-text">Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have BedrockAgentCoreFullAccess policy: AmazonSageMaker-ExecutionRole-20250525T153161</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have wildcard AgentCore permissions on all resources: agentcore-wildrydes_gateway_role_ab3991f6-role</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have not accessed AgentCore in 60+ days: role 'AmazonSageMaker-ExecutionRole-20250525T153161' (199 days), role 'AWSServiceRoleForBedrockAgentCoreRuntimeIdentity' (199 days), role 'CustomerSupportAssistantBedrockAgentCoreRole-us-east-1' (199 days), role 'resco-aiml-security-19304-AgentCoreSecurityAssessme-w773pPsFWNsn' (82 days)</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="Global">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'agentcore-wildrydes_gateway_role_ab3991f6-role', role 'AIMLSecurityMemberRole', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b', role 'aws-api-mcp-server-execution-role', role 'CloudSeerTrustedServiceRole', role 'CustomerSupportStackInfra-RuntimeAgentCoreRole-N188nLB5RtLO', role 'IDP-AnalyticsProcessorFunctionRole-H3gwkJtNqrqW'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'CustomerSupportMemory-x69jBq5GLp' (CustomerSupportMemory-x69jBq5GLp) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'cdk_agent_core_mem-uxfIagADuF' (cdk_agent_core_mem-uxfIagADuF) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'wildrydes_memory_ab3991f6-9FjiHOHjT2' (wildrydes_memory_ab3991f6-9FjiHOHjT2) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore VPC endpoints found in 4 VPCs. AgentCore API traffic traverses public internet, exposing it to interception.</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+            <td><code>111122223333</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore IAM Full Access Policy</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following roles have BedrockAgentCoreFullAccess policy: AmazonSageMaker-ExecutionRole-20250525T153161</p></div>
+                        <div><strong>Resolution</strong><p>Replace with least-privilege policies scoped to specific AgentCore resources and actions</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: The following AgentCore resources do not have resource-based policies: Runtime 'origami_expeditions', Runtime 'neoCyan_Agent', Runtime 'customer_support_agent', Runtime 'cdk_agent_core', Runtime 'awsapimcpserver' and 2 more. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>AC-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore IAM Wildcard Permissions</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following roles have wildcard AgentCore permissions on all resources: agentcore-wildrydes_gateway_role_ab3991f6-role</p></div>
+                        <div><strong>Resolution</strong><p>Scope permissions to specific AgentCore resources using resource ARNs</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>AC-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Stale Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following principals have not accessed AgentCore in 60+ days: role 'AmazonSageMaker-ExecutionRole-20250525T153161' (200 days), role 'AWSServiceRoleForBedrockAgentCoreRuntimeIdentity' (200 days), role 'CustomerSupportAssistantBedrockAgentCoreRole-us-east-1' (200 days), role 'resco-aiml-security-19304-AgentCoreSecurityAssessme-w773pPsFWNsn' (82 days)</p></div>
+                        <div><strong>Resolution</strong><p>Review and remove unused AgentCore permissions following least privilege principle</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="Global">
+            <td><code>111122223333</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Unused Permissions</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following principals have AgentCore permissions but have never accessed the service: role 'agentcore-wildrydes_gateway_role_ab3991f6-role', role 'AIMLSecurityMemberRole', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b', role 'aws-api-mcp-server-execution-role', role 'CloudSeerTrustedServiceRole', role 'CustomerSupportStackInfra-RuntimeAgentCoreRole-N188nLB5RtLO', role 'IDP-AnalyticsProcessorFunctionRole-H3gwkJtNqrqW'</p></div>
+                        <div><strong>Resolution</strong><p>Review and remove unused AgentCore permissions following least privilege principle</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: The following Gateways do not use customer-managed KMS encryption: 'customersupport-gw', 'wildrydes-gateway-ab3991f6'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>Global</code></td>
+            <td><code>AC-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Service-Linked Role Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</p></div>
+                        <div><strong>Resolution</strong><p>The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime VPC Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime VPC Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime VPC Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime VPC Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime VPC Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime CloudWatch Logs</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs for monitoring and troubleshooting</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime X-Ray Tracing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable X-Ray tracing for distributed tracing and performance analysis</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime CloudWatch Logs</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs for monitoring and troubleshooting</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime X-Ray Tracing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable X-Ray tracing for distributed tracing and performance analysis</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime CloudWatch Logs</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs for monitoring and troubleshooting</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime X-Ray Tracing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable X-Ray tracing for distributed tracing and performance analysis</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime CloudWatch Logs</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs for monitoring and troubleshooting</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime X-Ray Tracing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable X-Ray tracing for distributed tracing and performance analysis</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime CloudWatch Logs</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs for monitoring and troubleshooting</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime X-Ray Tracing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable X-Ray tracing for distributed tracing and performance analysis</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore ECR Repository AWS-Managed Keys</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>ECR repository 'bedrock-agentcore-customer_support_agent' uses AWS-managed keys instead of customer-managed KMS keys</p></div>
+                        <div><strong>Resolution</strong><p>Consider using customer-managed KMS keys for better control and audit capabilities</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore ECR Repository AWS-Managed Keys</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>ECR repository 'bedrock-agentcore-origami_expeditions' uses AWS-managed keys instead of customer-managed KMS keys</p></div>
+                        <div><strong>Resolution</strong><p>Consider using customer-managed KMS keys for better control and audit capabilities</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime Storage Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have storage configuration for browser tools</p></div>
+                        <div><strong>Resolution</strong><p>Configure S3 storage for browser tool session recordings and artifacts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime Storage Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have storage configuration for browser tools</p></div>
+                        <div><strong>Resolution</strong><p>Configure S3 storage for browser tool session recordings and artifacts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime Storage Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have storage configuration for browser tools</p></div>
+                        <div><strong>Resolution</strong><p>Configure S3 storage for browser tool session recordings and artifacts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime Storage Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have storage configuration for browser tools</p></div>
+                        <div><strong>Resolution</strong><p>Configure S3 storage for browser tool session recordings and artifacts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Runtime Storage Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have storage configuration for browser tools</p></div>
+                        <div><strong>Resolution</strong><p>Configure S3 storage for browser tool session recordings and artifacts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Encryption</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Memory 'CustomerSupportMemory-x69jBq5GLp' (CustomerSupportMemory-x69jBq5GLp) does not have customer-managed encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable encryption with customer-managed KMS keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Encryption</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Memory 'cdk_agent_core_mem-uxfIagADuF' (cdk_agent_core_mem-uxfIagADuF) does not have customer-managed encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable encryption with customer-managed KMS keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Encryption</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Memory 'wildrydes_memory_ab3991f6-9FjiHOHjT2' (wildrydes_memory_ab3991f6-9FjiHOHjT2) does not have customer-managed encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable encryption with customer-managed KMS keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 2 Gateway resources</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore VPC endpoints found in 4 VPCs. AgentCore API traffic traverses public internet, exposing it to interception.</p></div>
+                        <div><strong>Resolution</strong><p>Create VPC interface endpoints for AgentCore services:
+1. com.amazonaws.region.bedrock-agentcore
+2. com.amazonaws.region.bedrock-agentcore-control
+3. com.amazonaws.region.bedrock-agentcore-runtime
+This enables private connectivity via AWS PrivateLink</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following AgentCore resources do not have resource-based policies: Runtime 'origami_expeditions', Runtime 'neoCyan_Agent', Runtime 'customer_support_agent', Runtime 'cdk_agent_core', Runtime 'awsapimcpserver' and 2 more. Without RBPs, access control relies solely on identity-based policies.</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to:
+1. Implement defense-in-depth access control
+2. Enable cross-account access control
+3. Restrict access based on source VPC or IP
+4. Implement hierarchical authorization for Agent Runtimes</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following Gateways do not use customer-managed KMS encryption: 'customersupport-gw', 'wildrydes-gateway-ab3991f6'. Gateway configuration data uses AWS-managed keys.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create gateways with customer-managed KMS keys for additional control
+2. AWS-managed keys are single-tenant and region-specific
+3. Consider CMK for enhanced audit capabilities and key rotation control</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) uses authorizerType CUSTOM_JWT.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</p></div>
+                        <div><strong>Resolution</strong><p>Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) does not expose DEBUG-level exception detail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) is not associated with an AWS WAF web ACL.</p></div>
+                        <div><strong>Resolution</strong><p>Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) uses authorizerType CUSTOM_JWT.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</p></div>
+                        <div><strong>Resolution</strong><p>Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) does not expose DEBUG-level exception detail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) is not associated with an AWS WAF web ACL.</p></div>
+                        <div><strong>Resolution</strong><p>Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'AmazonSageMaker-ExecutionRole-20231014T200029' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have BedrockAgentCoreFullAccess policy: AmazonSageMaker-ExecutionRole-20250525T153161</p></div>
+                        <div><strong>Resolution</strong><p>Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'AmazonSageMaker-ExecutionRole-20250525T153161' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have wildcard AgentCore permissions on all resources: agentcore-wildrydes_gateway_role_ab3991f6-role</p></div>
+                        <div><strong>Resolution</strong><p>Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'AmazonSageMakerServiceCatalogProductsExecutionRole' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>AG-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Stale AgentCore Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have not accessed AgentCore in 60+ days: role 'AmazonSageMaker-ExecutionRole-20250525T153161' (200 days), role 'AWSServiceRoleForBedrockAgentCoreRuntimeIdentity' (200 days), role 'CustomerSupportAssistantBedrockAgentCoreRole-us-east-1' (200 days), role 'resco-aiml-security-19304-AgentCoreSecurityAssessme-w773pPsFWNsn' (82 days)</p></div>
+                        <div><strong>Resolution</strong><p>Remove or restrict stale AgentCore permissions for principals that no longer need access.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="Global">
             <td><code>111122223333</code></td>
             <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'EMR_EC2_DefaultRole' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Stale AgentCore Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'agentcore-wildrydes_gateway_role_ab3991f6-role', role 'AIMLSecurityMemberRole', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b', role 'aws-api-mcp-server-execution-role', role 'CloudSeerTrustedServiceRole', role 'CustomerSupportStackInfra-RuntimeAgentCoreRole-N188nLB5RtLO', role 'IDP-AnalyticsProcessorFunctionRole-H3gwkJtNqrqW'</p></div>
+                        <div><strong>Resolution</strong><p>Remove or restrict stale AgentCore permissions for principals that no longer need access.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+            <td><code>111122223333</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'SageMaker-EMR-ExecutionRole' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-cz8qi7j81si3' (QuickSetupDomain-20250525T153160) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) is not configured with VPC. This exposes the runtime to public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-cz8qi7j81si3' (QuickSetupDomain-20250525T153160) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'QuickSetupDomain-20250525T153160' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have CloudWatch Logs configured</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have X-Ray tracing enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'CustomerSupportMemory-x69jBq5GLp' (CustomerSupportMemory-x69jBq5GLp) does not have customer-managed encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'cdk_agent_core_mem-uxfIagADuF' (cdk_agent_core_mem-uxfIagADuF) does not have customer-managed encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'wildrydes_memory_ab3991f6-9FjiHOHjT2' (wildrydes_memory_ab3991f6-9FjiHOHjT2) does not have customer-managed encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore VPC endpoints found in 4 VPCs. AgentCore API traffic traverses public internet, exposing it to interception.</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>AG-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: The following AgentCore resources do not have resource-based policies: Runtime 'origami_expeditions', Runtime 'neoCyan_Agent', Runtime 'customer_support_agent', Runtime 'cdk_agent_core', Runtime 'awsapimcpserver' and 2 more. Without RBPs, access control relies solely on identity-based policies.</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
+<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
             <td><code>111122223333</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: The following Gateways do not use customer-managed KMS encryption: 'customersupport-gw', 'wildrydes-gateway-ab3991f6'. Gateway configuration data uses AWS-managed keys.</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
 <tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-krxh4fmtaxjl' (PromptEvaluationDomain) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Non-VPC Only Network Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-krxh4fmtaxjl' (PromptEvaluationDomain) is not configured for VPC-only access</p></div>
+                        <div><strong>Resolution</strong><p>Configure the SageMaker domain to use VPC-only network access type</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -4746,10 +7150,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-krxh4fmtaxjl' (PromptEvaluationDomain) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SSO Not Properly Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-krxh4fmtaxjl' (PromptEvaluationDomain) is using authentication mode: IAM</p></div>
+                        <div><strong>Resolution</strong><p>Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -4757,10 +7168,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'PromptEvaluationDomain' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Missing Encryption Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Domain 'PromptEvaluationDomain' - No KMS key configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure encryption using AWS KMS customer managed keys for enhanced security</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
@@ -4768,10 +7186,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -4779,10 +7204,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4790,10 +7222,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4801,10 +7240,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4812,10 +7258,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4823,10 +7276,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4834,10 +7294,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4845,10 +7312,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4856,10 +7330,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4867,10 +7348,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4878,10 +7366,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4889,10 +7384,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4900,10 +7402,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4911,10 +7420,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4922,10 +7438,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4933,10 +7456,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4944,10 +7474,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4955,10 +7492,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4966,10 +7510,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4977,10 +7528,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4988,10 +7546,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -4999,10 +7564,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -5010,10 +7582,17 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -5021,29290 +7600,8763 @@ <h2>Security Assessment Overview</h2>
             <td><code>111122223333</code></td>
             <td><code>us-west-2</code></td>
             <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
             <td><code>111122223333</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 Gateway resources</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following AgentCore resources do not have resource-based policies: Gateway 'aws-news-mcp'. Without RBPs, access control relies solely on identity-based policies.</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to:
+1. Implement defense-in-depth access control
+2. Enable cross-account access control
+3. Restrict access based on source VPC or IP
+4. Implement hierarchical authorization for Agent Runtimes</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following Gateways do not use customer-managed KMS encryption: 'aws-news-mcp'. Gateway configuration data uses AWS-managed keys.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create gateways with customer-managed KMS keys for additional control
+2. AWS-managed keys are single-tenant and region-specific
+3. Consider CMK for enhanced audit capabilities and key rotation control</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) uses authorizerType CUSTOM_JWT.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</p></div>
+                        <div><strong>Resolution</strong><p>Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) does not expose DEBUG-level exception detail.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) is not associated with an AWS WAF web ACL.</p></div>
+                        <div><strong>Resolution</strong><p>Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: The following AgentCore resources do not have resource-based policies: Gateway 'aws-news-mcp'. Without RBPs, access control relies solely on identity-based policies.</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: The following Gateways do not use customer-managed KMS encryption: 'aws-news-mcp'. Gateway configuration data uses AWS-managed keys.</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity not used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock service VPC endpoints found in VPCs: vpc-0f85a6754ab37efb7, vpc-5c3b6524, vpc-03bcafcb58a3029fc</p></div>
+                        <div><strong>Resolution</strong><p>Create a VPC endpoint in your VPC with any of the following Bedrock service endpoints that your application may be using:
+- com.amazonaws.region.bedrock
+- com.amazonaws.region.bedrock-runtime
+- com.amazonaws.region.bedrock-agent
+- com.amazonaws.region.bedrock-agent-runtime</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging is not enabled. This limits your ability to track and audit model usage.</p></div>
+                        <div><strong>Resolution</strong><p>Enable model invocation logging to collect invocation logs, model input data, and model output data. Configure logging to deliver to Amazon S3, CloudWatch Logs, or both for comprehensive monitoring.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon Bedrock Guardrails are properly configured with 1 guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue monitoring and updating guardrails as needed.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue monitoring CloudTrail logs for Bedrock activity.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
+1. Create and version your prompts
+2. Test different prompt variants
+3. Share prompts across your organization
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'knowledge-base-bedrock-agent' (XSPYLN4FQL) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+2. For S3 data sources: Verify CMK-encrypted S3 buckets
+3. For RDS: Verify KMS encryption on the database
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (SUGAG7RGYD) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+2. For S3 data sources: Verify CMK-encrypted S3 buckets
+3. For RDS: Verify KMS encryption on the database
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'promptfoo-rag-workshop-111122223333-kb' (N74ZIKTUFL) uses 'RDS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+2. For S3 data sources: Verify CMK-encrypted S3 buckets
+3. For RDS: Verify KMS encryption on the database
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'InvestmentResearchKB' (M1GMUG3BP0) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+2. For S3 data sources: Verify CMK-encrypted S3 buckets
+3. For RDS: Verify KMS encryption on the database
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'knowledge-base-quick-start-xtwwd' (ENFHSBBLMV) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+2. For S3 data sources: Verify CMK-encrypted S3 buckets
+3. For RDS: Verify KMS encryption on the database
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'kb-s3-vector-store' (116IXQU5VP) uses 'S3_VECTORS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+2. For S3 data sources: Verify CMK-encrypted S3 buckets
+3. For RDS: Verify KMS encryption on the database
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following roles can invoke Bedrock models without enforced guardrails: 111122223333-us-east-1-kb-bedrock-service-role, agentcore-wildrydes_gateway_role_ab3991f6-role, AgentCoreEvalsSDK-us-east-1-d04ba7b68b, AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76, AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b, AmazonBedrockExecutionRoleForAgents_S0T9VNPP9D, AmazonBedrockExecutionRoleForAgents_WNCOPE29NZ, AmazonBedrockExecutionRoleForKnowledgeBase_072pr, AmazonBedrockExecutionRoleForKnowledgeBase_byjin, AmazonBedrockExecutionRoleForKnowledgeBase_h9718...</p></div>
+                        <div><strong>Resolution</strong><p>Add IAM policy conditions to enforce guardrail usage:
+1. Use 'bedrock:GuardrailIdentifier' condition key
+2. Specify required guardrail ARN or ID
+3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is using the 'CLASSIC' content-filter tier instead of 'STANDARD'. The STANDARD tier provides more robust content filtering and broader language support than the CLASSIC tier.</p></div>
+                        <div><strong>Resolution</strong><p>Update the guardrail to use the STANDARD content-filter tier for improved contextual understanding, better prompt attack filtering (distinguishing jailbreaks from prompt injection), and broader language support. The STANDARD tier requires cross-Region inference. Review pricing implications before upgrading.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</p></div>
+                        <div><strong>Resolution</strong><p>Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+2. For Amazon RDS/Aurora: verify KMS encryption on the database
+3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+2. For Amazon RDS/Aurora: verify KMS encryption on the database
+3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) uses 'RDS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+2. For Amazon RDS/Aurora: verify KMS encryption on the database
+3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+2. For Amazon RDS/Aurora: verify KMS encryption on the database
+3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+2. For Amazon RDS/Aurora: verify KMS encryption on the database
+3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+2. For Amazon RDS/Aurora: verify KMS encryption on the database
+3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>7 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</p></div>
+                        <div><strong>Resolution</strong><p>Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is missing content filters: VIOLENCE, SEXUAL, HATE, INSULTS. Complete content filter coverage is essential for comprehensive content safety.</p></div>
+                        <div><strong>Resolution</strong><p>Update guardrail to enable all content filters (HATE, INSULTS, SEXUAL, VIOLENCE). Configure appropriate threshold levels (LOW, MEDIUM, HIGH) for both input and output filtering based on your use case. Review AWS documentation for threshold guidance.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</p></div>
+                        <div><strong>Resolution</strong><p>Configure Automated Reasoning policies on guardrails to mathematically verify model responses. Define policies that specify allowed and disallowed behaviors. Use for high-assurance use cases where formal verification is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) has no sensitive-information filters configured (no PII entities or regex patterns). Prompts and model responses are not screened for sensitive data such as PII.</p></div>
+                        <div><strong>Resolution</strong><p>Configure sensitive-information filters on the guardrail: add PII entity types (e.g. NAME, EMAIL, SSN, CREDIT_DEBIT_CARD_NUMBER) and/or custom regex patterns, and set the appropriate BLOCK or ANONYMIZE action for input and output.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks (GROUNDING and RELEVANCE filter types) on the guardrail with appropriate thresholds. This is especially important for RAG applications to ensure responses are grounded in the retrieved source material.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 7 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is missing content filters: VIOLENCE, SEXUAL, HATE, INSULTS. Complete content filter coverage is essential for comprehensive content safety.</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) has no sensitive-information filters configured (no PII entities or regex patterns). Prompts and model responses are not screened for sensitive data such as PII.</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
+            <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
             <td><code>111122223333</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>AG-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>AG-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">AWS Shield Advanced Not Enabled</td>
-            <td class="finding-details">AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Subscribe to AWS Shield Advanced for DDoS protection.
-2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
-3. Enable Shield Response Team (SRT) access and configure proactive engagement.
-4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">AWS Shield Advanced Not Enabled</td>
-            <td class="finding-details">AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Subscribe to AWS Shield Advanced for DDoS protection.
-2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
-3. Enable Shield Response Team (SRT) access and configure proactive engagement.
-4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">No Regional WAF Web ACLs Found</td>
-            <td class="finding-details">No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</td>
-            <td class="resolution-text">1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
-2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
-3. Add AWS Managed Rules for known bad inputs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">No Regional WAF Web ACLs Found</td>
-            <td class="finding-details">No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</td>
-            <td class="resolution-text">1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
-2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
-3. Add AWS Managed Rules for known bad inputs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-02</code></td>
-            <td class="col-domain">API Gateway Usage Plans Missing Throttle</td>
-            <td class="finding-details">Usage plans without throttling: myAskMeAnything-UsagePlan. Unbounded API calls can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">Set rateLimit and burstLimit on all usage plans associated with GenAI API stages. Consider per-consumer API keys with individual quotas.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-02</code></td>
-            <td class="col-domain">API Gateway Usage Plans Missing Throttle</td>
-            <td class="finding-details">Usage plans without throttling: myAskMeAnything-UsagePlan. Unbounded API calls can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">Set rateLimit and burstLimit on all usage plans associated with GenAI API stages. Consider per-consumer API keys with individual quotas.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-03</code></td>
-            <td class="col-domain">Bedrock Token Quotas Customized</td>
-            <td class="finding-details">Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</td>
-            <td class="resolution-text">No action required. Periodically re-review quotas against expected peak load.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>FS-03</code></td>
-            <td class="col-domain">Bedrock Token Quotas Customized</td>
-            <td class="finding-details">Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</td>
-            <td class="resolution-text">No action required. Periodically re-review quotas against expected peak load.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-04</code></td>
-            <td class="col-domain">No Cost Anomaly Detection Monitors</td>
-            <td class="finding-details">No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</td>
-            <td class="resolution-text">1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
-2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
-3. Set daily spend budgets with AWS Budgets as a secondary control.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>FS-04</code></td>
-            <td class="col-domain">No Cost Anomaly Detection Monitors</td>
-            <td class="finding-details">No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</td>
-            <td class="resolution-text">1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
-2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
-3. Set daily spend budgets with AWS Budgets as a secondary control.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-05</code></td>
-            <td class="col-domain">No Bedrock CloudWatch Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms for:
-- AWS/Bedrock InvocationThrottles (threshold > 0)
-- AWS/Bedrock TokensProcessed (threshold based on quota)
-- Custom application-level token counters via EMF</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>FS-05</code></td>
-            <td class="col-domain">No Bedrock CloudWatch Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms for:
-- AWS/Bedrock InvocationThrottles (threshold > 0)
-- AWS/Bedrock TokensProcessed (threshold based on quota)
-- Custom application-level token counters via EMF</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-06</code></td>
-            <td class="col-domain">No AI/ML Service Budgets Configured</td>
-            <td class="finding-details">No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</td>
-            <td class="resolution-text">1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
-2. Add SNS notifications to on-call channels.
-3. Consider budget actions to apply IAM deny policies when thresholds are breached.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>FS-06</code></td>
-            <td class="col-domain">No AI/ML Service Budgets Configured</td>
-            <td class="finding-details">No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</td>
-            <td class="resolution-text">1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
-2. Add SNS notifications to on-call channels.
-3. Consider budget actions to apply IAM deny policies when thresholds are breached.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-07</code></td>
-            <td class="col-domain">Agent Action Boundary Check</td>
-            <td class="finding-details">No Bedrock agents found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>FS-07</code></td>
-            <td class="col-domain">Agent Action Boundary Check</td>
-            <td class="finding-details">No Bedrock agents found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
+1. Create and version your prompts
+2. Test different prompt variants
+3. Share prompts across your organization
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-08</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing Policy Engine</td>
-            <td class="finding-details">Runtimes without authorizer configuration: origami_expeditions, neoCyan_Agent, customer_support_agent, cdk_agent_core, awsapimcpserver. Without a policy engine, agents can invoke any registered tool without authorization checks.</td>
-            <td class="resolution-text">Configure an authorizer (Lambda or Cedar policy store) on each AgentCore runtime to enforce fine-grained tool-call authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-08</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing Policy Engine</td>
-            <td class="finding-details">Runtimes without authorizer configuration: origami_expeditions, neoCyan_Agent, customer_support_agent, cdk_agent_core, awsapimcpserver. Without a policy engine, agents can invoke any registered tool without authorization checks.</td>
-            <td class="resolution-text">Configure an authorizer (Lambda or Cedar policy store) on each AgentCore runtime to enforce fine-grained tool-call authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-09</code></td>
-            <td class="col-domain">Agent Lambda Functions Without Concurrency Limits</td>
-            <td class="finding-details">Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-111122223333-FinServAssessment, resco-aiml-IAMPermissionCaching, aiml-security-aiml-security-111122223333-SagemakerAssessment, resco-aiml-CleanupBucket, aiml-security-aiml-security-111122223333-BedrockAssessment, resco-aiml-BedrockAssessment, aiml-security-aiml-security-111122223333-CleanupBucket, aiml-security-aiml-security-111122223333-AgentCoreAssessment, e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Unlimited concurrency allows runaway agent loops to exhaust account limits.</td>
-            <td class="resolution-text">1. Set reserved concurrency on agent Lambda functions.
-2. Implement maximum iteration counts in agent orchestration logic.
-3. Use Step Functions with MaxConcurrency and timeout states.
-4. Add circuit-breaker patterns to agent tool invocations.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-09</code></td>
-            <td class="col-domain">Agent Lambda Functions Without Concurrency Limits</td>
-            <td class="finding-details">Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-111122223333-FinServAssessment, resco-aiml-IAMPermissionCaching, aiml-security-aiml-security-111122223333-SagemakerAssessment, resco-aiml-CleanupBucket, aiml-security-aiml-security-111122223333-BedrockAssessment, resco-aiml-BedrockAssessment, aiml-security-aiml-security-111122223333-CleanupBucket, aiml-security-aiml-security-111122223333-AgentCoreAssessment, e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Unlimited concurrency allows runaway agent loops to exhaust account limits.</td>
-            <td class="resolution-text">1. Set reserved concurrency on agent Lambda functions.
-2. Implement maximum iteration counts in agent orchestration logic.
-3. Use Step Functions with MaxConcurrency and timeout states.
-4. Add circuit-breaker patterns to agent tool invocations.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-10</code></td>
-            <td class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</td>
-            <td class="finding-details">No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</td>
-            <td class="resolution-text">Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-10</code></td>
-            <td class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</td>
-            <td class="finding-details">No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</td>
-            <td class="resolution-text">Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-11</code></td>
-            <td class="col-domain">No Agent Rate Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms on:
-- Bedrock agent invocation counts (threshold based on expected max)
-- Lambda invocation errors for agent functions
-- Step Functions execution failures and timeouts</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-11</code></td>
-            <td class="col-domain">No Agent Rate Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms on:
-- Bedrock agent invocation counts (threshold based on expected max)
-- Lambda invocation errors for agent functions
-- Step Functions execution failures and timeouts</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-12</code></td>
-            <td class="col-domain">No Bedrock-Scoped SCPs Found</td>
-            <td class="finding-details">No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</td>
-            <td class="resolution-text">1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
-2. Use bedrock:ModelId condition key to allowlist approved models.
-3. Maintain a model inventory and update the SCP when models are approved/retired.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-12</code></td>
-            <td class="col-domain">No Bedrock-Scoped SCPs Found</td>
-            <td class="finding-details">No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</td>
-            <td class="resolution-text">1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
-2. Use bedrock:ModelId condition key to allowlist approved models.
-3. Maintain a model inventory and update the SCP when models are approved/retired.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-13</code></td>
-            <td class="col-domain">Model Provenance Tags Present</td>
-            <td class="finding-details">All reviewed models have required provenance tags.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-13</code></td>
-            <td class="col-domain">Model Provenance Tags Present</td>
-            <td class="finding-details">All reviewed models have required provenance tags.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-14</code></td>
-            <td class="col-domain">Model Governance Config Rules Present</td>
-            <td class="finding-details">Found 11 model-related Config rule(s).</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-14</code></td>
-            <td class="col-domain">Model Governance Config Rules Present</td>
-            <td class="finding-details">Found 11 model-related Config rule(s).</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-15</code></td>
-            <td class="col-domain">No Bedrock Evaluation Jobs Found</td>
-            <td class="finding-details">No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</td>
-            <td class="resolution-text">1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
-2. Use FMEval library for automated robustness testing.
-3. Schedule periodic re-evaluation after model updates.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-15</code></td>
-            <td class="col-domain">No Bedrock Evaluation Jobs Found</td>
-            <td class="finding-details">No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</td>
-            <td class="resolution-text">1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
-2. Use FMEval library for automated robustness testing.
-3. Schedule periodic re-evaluation after model updates.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-16</code></td>
-            <td class="col-domain">ECR Repositories Without Image Scanning</td>
-            <td class="finding-details">4 ECR repo(s) without scan-on-push: mlexplorationrepo, cdk-hnb659fds-container-assets-111122223333-us-east-1, bedrock-agentcore-customer_support_agent, bedrock-agentcore-origami_expeditions.</td>
-            <td class="resolution-text">Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-16</code></td>
-            <td class="col-domain">ECR Repositories Without Image Scanning</td>
-            <td class="finding-details">4 ECR repo(s) without scan-on-push: mlexplorationrepo, cdk-hnb659fds-container-assets-111122223333-us-east-1, bedrock-agentcore-customer_support_agent, bedrock-agentcore-origami_expeditions.</td>
-            <td class="resolution-text">Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-20</code></td>
-            <td class="col-domain">No SageMaker Feature Groups Found</td>
-            <td class="finding-details">No SageMaker Feature Store groups found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-20</code></td>
-            <td class="col-domain">No SageMaker Feature Groups Found</td>
-            <td class="finding-details">No SageMaker Feature Store groups found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-21</code></td>
-            <td class="col-domain">Training Data Buckets Without Versioning</td>
-            <td class="finding-details">13 training data bucket(s) without versioning: ancbedrocklogging, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, fsi-genai-workshop-bedrock-datasources-111122223333-us-west-2, knowledgebase-bedrock-agent-agasthik, llmevaluationpromptfoo-bedrockkb-cozhbzbrcmd2, sagemaker-studio-111122223333-huo1mvme4t.</td>
-            <td class="resolution-text">Enable S3 versioning on all training data buckets. Consider enabling MFA Delete for additional protection against poisoning.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-21</code></td>
-            <td class="col-domain">Training Data Buckets Without Versioning</td>
-            <td class="finding-details">13 training data bucket(s) without versioning: ancbedrocklogging, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, fsi-genai-workshop-bedrock-datasources-111122223333-us-west-2, knowledgebase-bedrock-agent-agasthik, llmevaluationpromptfoo-bedrockkb-cozhbzbrcmd2, sagemaker-studio-111122223333-huo1mvme4t.</td>
-            <td class="resolution-text">Enable S3 versioning on all training data buckets. Consider enabling MFA Delete for additional protection against poisoning.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-22</code></td>
-            <td class="col-domain">Overly Permissive Knowledge Base IAM Roles</td>
-            <td class="finding-details">827 role(s) with wildcard KB permissions:
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateKnowledgeBase' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateDataSource' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'Admin' allows '*'
-- Role 'agentcore-wildrydes_gateway_role_ab3991f6-role' allows 'bedrock:*'
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'Agentic-AI-MCP-Strands-SDK-Works-VSCodeInstanceRole-NCTUnlnRBFO6' allows '*'
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)</td>
-            <td class="resolution-text">Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-22</code></td>
-            <td class="col-domain">Overly Permissive Knowledge Base IAM Roles</td>
-            <td class="finding-details">827 role(s) with wildcard KB permissions:
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateKnowledgeBase' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateDataSource' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'Admin' allows '*'
-- Role 'agentcore-wildrydes_gateway_role_ab3991f6-role' allows 'bedrock:*'
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'Agentic-AI-MCP-Strands-SDK-Works-VSCodeInstanceRole-NCTUnlnRBFO6' allows '*'
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)</td>
-            <td class="resolution-text">Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-24</code></td>
-            <td class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</td>
-            <td class="finding-details">Found 3 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</td>
-            <td class="resolution-text">1. Add metadata fields (tenantId, dataClassification) to KB data sources.
-2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
-3. Validate filters in integration tests to prevent cross-tenant data leakage.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-24</code></td>
-            <td class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</td>
-            <td class="finding-details">Found 3 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</td>
-            <td class="resolution-text">1. Add metadata fields (tenantId, dataClassification) to KB data sources.
-2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
-3. Validate filters in integration tests to prevent cross-tenant data leakage.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-25</code></td>
-            <td class="col-domain">OpenSearch Serverless Encryption Policies Present</td>
-            <td class="finding-details">Found 5 encryption policy(ies); 5 use a customer-managed KMS key.</td>
-            <td class="resolution-text">Verify all vector store collections use customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-25</code></td>
-            <td class="col-domain">OpenSearch Serverless Encryption Policies Present</td>
-            <td class="finding-details">Found 5 encryption policy(ies); 5 use a customer-managed KMS key.</td>
-            <td class="resolution-text">Verify all vector store collections use customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-26</code></td>
-            <td class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</td>
-            <td class="finding-details">Found 5 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</td>
-            <td class="resolution-text">Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-26</code></td>
-            <td class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</td>
-            <td class="finding-details">Found 5 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</td>
-            <td class="resolution-text">Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">Contextual Grounding Enabled on Guardrails</td>
-            <td class="finding-details">Guardrails with contextual grounding: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required for contextual grounding. Also consider enabling Automated Reasoning checks for formal policy verification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">Contextual Grounding Enabled on Guardrails</td>
-            <td class="finding-details">Guardrails with contextual grounding: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required for contextual grounding. Also consider enabling Automated Reasoning checks for formal policy verification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">No Automated Reasoning Policies Found</td>
-            <td class="finding-details">No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</td>
-            <td class="resolution-text">1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
-2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
-3. Set confidenceThreshold on the policy to control strictness.
-4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
-5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">No Automated Reasoning Policies Found</td>
-            <td class="finding-details">No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</td>
-            <td class="resolution-text">1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
-2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
-3. Set confidenceThreshold on the policy to control strictness.
-4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
-5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-28</code></td>
-            <td class="col-domain">Denied Topics Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides broader language support and improved detection for denied topics.</td>
-            <td class="resolution-text">Verify topics cover regulated financial advice categories. For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (set topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile on the guardrail). When authoring denied-topic policies, use existing compliance materials as the source: employee policies, training materials, procedure documents, and incident reports (PDF §1.2.1 Practical guidance).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-28</code></td>
-            <td class="col-domain">Denied Topics Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides broader language support and improved detection for denied topics.</td>
-            <td class="resolution-text">Verify topics cover regulated financial advice categories. For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (set topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile on the guardrail). When authoring denied-topic policies, use existing compliance materials as the source: employee policies, training materials, procedure documents, and incident reports (PDF §1.2.1 Practical guidance).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-29</code></td>
-            <td class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</td>
-            <td class="resolution-text">1. Implement post-processing to append required disclaimers to GenAI outputs.
-2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
-3. Document disclaimer requirements in the AI use case register.
-4. Test disclaimer presence in QA/UAT before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-29</code></td>
-            <td class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</td>
-            <td class="resolution-text">1. Implement post-processing to append required disclaimers to GenAI outputs.
-2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
-3. Document disclaimer requirements in the AI use case register.
-4. Test disclaimer presence in QA/UAT before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-30</code></td>
-            <td class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with compliance-specific datasets:
-- Fair lending test cases (ECOA, Fair Housing Act)
-- UDAP/UDAAP unfair/deceptive practice scenarios
-- AML/KYC edge cases</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-30</code></td>
-            <td class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with compliance-specific datasets:
-- Fair lending test cases (ECOA, Fair Housing Act)
-- UDAP/UDAAP unfair/deceptive practice scenarios
-- AML/KYC edge cases</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-31</code></td>
-            <td class="col-domain">Knowledge Base Data Sources Past Review Threshold</td>
-            <td class="finding-details">2 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
-- KB 'knowledge-base-semiconductors' source 'knowledge-base-quick-start-qpvuv-data-source' last synced 722 days ago
-- KB '111122223333-us-east-1-kb' source '111122223333-us-east-1-kb-datasource' last synced 199 days ago
-Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</td>
-            <td class="resolution-text">1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
-2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
-3. Set CloudWatch alarms on sync job failures.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-31</code></td>
-            <td class="col-domain">Knowledge Base Data Sources Past Review Threshold</td>
-            <td class="finding-details">2 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
-- KB 'knowledge-base-semiconductors' source 'knowledge-base-quick-start-qpvuv-data-source' last synced 722 days ago
-- KB '111122223333-us-east-1-kb' source '111122223333-us-east-1-kb-datasource' last synced 199 days ago
-Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</td>
-            <td class="resolution-text">1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
-2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
-3. Set CloudWatch alarms on sync job failures.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-32</code></td>
-            <td class="col-domain">ADVISORY: Source Attribution — Manual Review Required</td>
-            <td class="finding-details">Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</td>
-            <td class="resolution-text">1. Use Bedrock RetrieveAndGenerate with citations enabled.
-2. Include source document references in response post-processing.
-3. Test citation accuracy in QA before production deployment.
-4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-32</code></td>
-            <td class="col-domain">ADVISORY: Source Attribution — Manual Review Required</td>
-            <td class="finding-details">Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</td>
-            <td class="resolution-text">1. Use Bedrock RetrieveAndGenerate with citations enabled.
-2. Include source document references in response post-processing.
-3. Test citation accuracy in QA before production deployment.
-4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-33</code></td>
-            <td class="col-domain">KB Data Source Buckets Without Versioning</td>
-            <td class="finding-details">KB data source S3 buckets without versioning: 111122223333-us-east-1-kb-data-bucket.</td>
-            <td class="resolution-text">Enable S3 versioning on all KB data source buckets. Enable S3 Object Integrity (checksum) for tamper detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-33</code></td>
-            <td class="col-domain">KB Data Source Buckets Without Versioning</td>
-            <td class="finding-details">KB data source S3 buckets without versioning: 111122223333-us-east-1-kb-data-bucket.</td>
-            <td class="resolution-text">Enable S3 versioning on all KB data source buckets. Enable S3 Object Integrity (checksum) for tamper detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-34</code></td>
-            <td class="col-domain">Legacy Foundation Models Available in Region</td>
-            <td class="finding-details">Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</td>
-            <td class="resolution-text">1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
-2. Migrate active usage to current model versions.
-3. Document training-data cutoff dates for all models in use.
-4. Add data-currency disclaimers to outputs from models with old cutoffs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-34</code></td>
-            <td class="col-domain">Legacy Foundation Models Available in Region</td>
-            <td class="finding-details">Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</td>
-            <td class="resolution-text">1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
-2. Migrate active usage to current model versions.
-3. Document training-data cutoff dates for all models in use.
-4. Add data-currency disclaimers to outputs from models with old cutoffs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-35</code></td>
-            <td class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation or FMEval with harmful content datasets:
-- Toxicity detection
-- Hate speech classification
-- Violence/self-harm content</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-35</code></td>
-            <td class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation or FMEval with harmful content datasets:
-- Toxicity detection
-- Hate speech classification
-- Violence/self-harm content</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-36</code></td>
-            <td class="col-domain">Guardrail Content Filters on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with content filters: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides improved contextual understanding, typographical error detection, 60+ language support, and better prompt-attack classification (distinguishes jailbreaks from prompt injection).</td>
-            <td class="resolution-text">Consider upgrading to STANDARD tier content filters for FinServ workloads that handle multiple languages or require higher detection accuracy. STANDARD tier requires cross-region inference (crossRegionDetails.guardrailProfileArn on the guardrail). To upgrade: update the guardrail's contentPolicy.filtersConfig.contentFiltersTierConfig with tierName=STANDARD and configure a guardrail cross-region profile.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-36</code></td>
-            <td class="col-domain">Guardrail Content Filters on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with content filters: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides improved contextual understanding, typographical error detection, 60+ language support, and better prompt-attack classification (distinguishes jailbreaks from prompt injection).</td>
-            <td class="resolution-text">Consider upgrading to STANDARD tier content filters for FinServ workloads that handle multiple languages or require higher detection accuracy. STANDARD tier requires cross-region inference (crossRegionDetails.guardrailProfileArn on the guardrail). To upgrade: update the guardrail's contentPolicy.filtersConfig.contentFiltersTierConfig with tierName=STANDARD and configure a guardrail cross-region profile.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-37</code></td>
-            <td class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</td>
-            <td class="finding-details">User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
-2. Route flagged outputs to human reviewers via SQS/SNS.
-3. Log feedback to DynamoDB/S3 for model improvement.
-4. Define SLAs for reviewing flagged content.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-37</code></td>
-            <td class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</td>
-            <td class="finding-details">User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
-2. Route flagged outputs to human reviewers via SQS/SNS.
-3. Log feedback to DynamoDB/S3 for model improvement.
-4. Define SLAs for reviewing flagged content.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-38</code></td>
-            <td class="col-domain">No Guardrails With Word Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have word/phrase filters. Profanity and prohibited financial terms may appear in outputs.</td>
-            <td class="resolution-text">Add word filters to guardrails:
-- Enable AWS managed profanity list
-- Add custom denylist for prohibited financial terms
-- Add allowlist for required regulatory language</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-38</code></td>
-            <td class="col-domain">No Guardrails With Word Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have word/phrase filters. Profanity and prohibited financial terms may appear in outputs.</td>
-            <td class="resolution-text">Add word filters to guardrails:
-- Enable AWS managed profanity list
-- Add custom denylist for prohibited financial terms
-- Add allowlist for required regulatory language</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-39</code></td>
-            <td class="col-domain">No SageMaker Clarify Bias Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
-2. Define protected attributes (age, gender, race proxies).
-3. Set bias metric thresholds and alert on violations.
-4. Document bias testing results for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-39</code></td>
-            <td class="col-domain">No SageMaker Clarify Bias Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
-2. Define protected attributes (age, gender, race proxies).
-3. Set bias metric thresholds and alert on violations.
-4. Document bias testing results for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-40</code></td>
-            <td class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with bias test datasets:
-- Demographic parity test cases
-- Equal opportunity scenarios
-- Counterfactual fairness tests</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-40</code></td>
-            <td class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with bias test datasets:
-- Demographic parity test cases
-- Equal opportunity scenarios
-- Counterfactual fairness tests</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-41</code></td>
-            <td class="col-domain">No SageMaker Clarify Explainability Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify explainability for credit/lending models.
-2. Generate SHAP values for feature importance.
-3. Map top features to human-readable adverse action reason codes.
-4. Store explanations for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-41</code></td>
-            <td class="col-domain">No SageMaker Clarify Explainability Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify explainability for credit/lending models.
-2. Generate SHAP values for feature importance.
-3. Map top features to human-readable adverse action reason codes.
-4. Store explanations for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-42</code></td>
-            <td class="col-domain">No SageMaker Model Cards Found</td>
-            <td class="finding-details">No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</td>
-            <td class="resolution-text">1. Create SageMaker Model Cards for all production models.
-2. Document: intended use, out-of-scope uses, training data, bias evaluations.
-3. Include regulatory compliance attestations.
-4. Review and update cards at each model version release.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-42</code></td>
-            <td class="col-domain">No SageMaker Model Cards Found</td>
-            <td class="finding-details">No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</td>
-            <td class="resolution-text">1. Create SageMaker Model Cards for all production models.
-2. Document: intended use, out-of-scope uses, training data, bias evaluations.
-3. Include regulatory compliance attestations.
-4. Review and update cards at each model version release.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-43</code></td>
-            <td class="col-domain">No CloudWatch Logs Data Protection Policies</td>
-            <td class="finding-details">No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</td>
-            <td class="resolution-text">1. Create CloudWatch Logs data protection policies to mask PII.
-2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
-3. Apply policies to Bedrock invocation log groups.
-4. Test masking with synthetic PII before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-43</code></td>
-            <td class="col-domain">No CloudWatch Logs Data Protection Policies</td>
-            <td class="finding-details">No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</td>
-            <td class="resolution-text">1. Create CloudWatch Logs data protection policies to mask PII.
-2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
-3. Apply policies to Bedrock invocation log groups.
-4. Test masking with synthetic PII before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-44</code></td>
-            <td class="col-domain">Amazon Macie Enabled</td>
-            <td class="finding-details">Amazon Macie is enabled and scanning S3 buckets.</td>
-            <td class="resolution-text">Verify Macie jobs cover training data and KB data source buckets.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-44</code></td>
-            <td class="col-domain">Amazon Macie Enabled</td>
-            <td class="finding-details">Amazon Macie is enabled and scanning S3 buckets.</td>
-            <td class="resolution-text">Verify Macie jobs cover training data and KB data source buckets.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-45</code></td>
-            <td class="col-domain">Guardrail PII Filters Configured</td>
-            <td class="finding-details">Guardrails with PII filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-45</code></td>
-            <td class="col-domain">Guardrail PII Filters Configured</td>
-            <td class="finding-details">Guardrails with PII filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-46</code></td>
-            <td class="col-domain">AI/ML Buckets Without Data Classification Tags</td>
-            <td class="finding-details">18 AI/ML bucket(s) without data-classification tags: 111122223333-us-east-1-kb-data-bucket, ancbedrocklogging, ancknowledgebase, aws-streaming-data-solut-outputaccesslogsbucket8b-1o7m0kb4bafm4, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, create-customer-resources-kb-bucket-111122223333.</td>
-            <td class="resolution-text">Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-46</code></td>
-            <td class="col-domain">AI/ML Buckets Without Data Classification Tags</td>
-            <td class="finding-details">18 AI/ML bucket(s) without data-classification tags: 111122223333-us-east-1-kb-data-bucket, ancbedrocklogging, ancknowledgebase, aws-streaming-data-solut-outputaccesslogsbucket8b-1o7m0kb4bafm4, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, create-customer-resources-kb-bucket-111122223333.</td>
-            <td class="resolution-text">Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-47</code></td>
-            <td class="col-domain">Guardrail Grounding Thresholds Appropriate</td>
-            <td class="finding-details">All 1 guardrail(s) with a GROUNDING filter have thresholds ≥0.7.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-47</code></td>
-            <td class="col-domain">Guardrail Grounding Thresholds Appropriate</td>
-            <td class="finding-details">All 1 guardrail(s) with a GROUNDING filter have thresholds ≥0.7.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-48</code></td>
-            <td class="col-domain">Active Knowledge Bases for RAG Present</td>
-            <td class="finding-details">Found 3 active Knowledge Base(s) for RAG grounding.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-48</code></td>
-            <td class="col-domain">Active Knowledge Bases for RAG Present</td>
-            <td class="finding-details">Found 3 active Knowledge Base(s) for RAG grounding.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-49</code></td>
-            <td class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
-2. Implement post-processing to append disclaimers.
-3. Test disclaimer presence in QA before production.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-49</code></td>
-            <td class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
-2. Implement post-processing to append disclaimers.
-3. Test disclaimer presence in QA before production.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-50</code></td>
-            <td class="col-domain">Relevance Grounding Filters Present</td>
-            <td class="finding-details">Guardrails with RELEVANCE grounding filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-50</code></td>
-            <td class="col-domain">Relevance Grounding Filters Present</td>
-            <td class="finding-details">Guardrails with RELEVANCE grounding filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-51</code></td>
-            <td class="col-domain">No Guardrails With Prompt Attack Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have PROMPT_ATTACK filters. Prompt injection attacks may bypass system prompts and access controls.</td>
-            <td class="resolution-text">1. Enable PROMPT_ATTACK content filter in Bedrock Guardrails.
-2. Set input filter strength to HIGH.
-3. Use input tags (<amazon-bedrock-guardrails-guardContent_xyz>) to differentiate user inputs from developer-provided prompts — required for PROMPT_ATTACK filters to work correctly with InvokeModel/InvokeModelWithResponseStream.
-4. Consider STANDARD tier (GA June 2025) for better jailbreak vs. injection classification and broader language support.
-5. Implement application-level input sanitization as defense-in-depth.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-prompt-attack.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-51</code></td>
-            <td class="col-domain">No Guardrails With Prompt Attack Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have PROMPT_ATTACK filters. Prompt injection attacks may bypass system prompts and access controls.</td>
-            <td class="resolution-text">1. Enable PROMPT_ATTACK content filter in Bedrock Guardrails.
-2. Set input filter strength to HIGH.
-3. Use input tags (<amazon-bedrock-guardrails-guardContent_xyz>) to differentiate user inputs from developer-provided prompts — required for PROMPT_ATTACK filters to work correctly with InvokeModel/InvokeModelWithResponseStream.
-4. Consider STANDARD tier (GA June 2025) for better jailbreak vs. injection classification and broader language support.
-5. Implement application-level input sanitization as defense-in-depth.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-prompt-attack.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-52</code></td>
-            <td class="col-domain">Bedrock Lambda Functions on Deprecated Runtimes</td>
-            <td class="finding-details">Functions on deprecated runtimes: e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Deprecated runtimes may use outdated boto3/SDK versions lacking security patches.</td>
-            <td class="resolution-text">1. Upgrade Lambda functions to a supported runtime — Python 3.12+, Node.js 22.x or 24.x, Java 21+, or .NET 8+.
-2. Update boto3 to the latest version in Lambda layers (pin the version in requirements.txt and redeploy).
-3. Enable Lambda runtime management controls for automatic minor-version updates (runtimeManagementConfig.updateRuntimeOn = 'Auto').
-4. Refer to https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html for the authoritative list of supported and deprecated runtimes.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-52</code></td>
-            <td class="col-domain">Bedrock Lambda Functions on Deprecated Runtimes</td>
-            <td class="finding-details">Functions on deprecated runtimes: e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Deprecated runtimes may use outdated boto3/SDK versions lacking security patches.</td>
-            <td class="resolution-text">1. Upgrade Lambda functions to a supported runtime — Python 3.12+, Node.js 22.x or 24.x, Java 21+, or .NET 8+.
-2. Update boto3 to the latest version in Lambda layers (pin the version in requirements.txt and redeploy).
-3. Enable Lambda runtime management controls for automatic minor-version updates (runtimeManagementConfig.updateRuntimeOn = 'Auto').
-4. Refer to https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html for the authoritative list of supported and deprecated runtimes.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-53</code></td>
-            <td class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF Web ACLs with injection protection rules (see FS-01).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-53</code></td>
-            <td class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF Web ACLs with injection protection rules (see FS-01).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-54</code></td>
-            <td class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</td>
-            <td class="finding-details">Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</td>
-            <td class="resolution-text">1. Conduct penetration testing of GenAI applications at least annually and before major releases.
-2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
-3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
-4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
-5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-54</code></td>
-            <td class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</td>
-            <td class="finding-details">Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</td>
-            <td class="resolution-text">1. Conduct penetration testing of GenAI applications at least annually and before major releases.
-2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
-3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
-4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
-5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-55</code></td>
-            <td class="col-domain">No Output Validation Functions Found</td>
-            <td class="finding-details">No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</td>
-            <td class="resolution-text">1. Implement output validation Lambda functions in GenAI pipelines.
-2. Validate output schema, length, and content before downstream use.
-3. Sanitize outputs before rendering in web UIs (XSS prevention).
-4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-55</code></td>
-            <td class="col-domain">No Output Validation Functions Found</td>
-            <td class="finding-details">No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</td>
-            <td class="resolution-text">1. Implement output validation Lambda functions in GenAI pipelines.
-2. Validate output schema, length, and content before downstream use.
-3. Sanitize outputs before rendering in web UIs (XSS prevention).
-4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-56</code></td>
-            <td class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF ACLs with XSS prevention rules.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-56</code></td>
-            <td class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF ACLs with XSS prevention rules.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-57</code></td>
-            <td class="col-domain">ADVISORY: Output Encoding — Manual Review Required</td>
-            <td class="finding-details">Output encoding practices cannot be verified via AWS APIs. Manual code review required.</td>
-            <td class="resolution-text">1. HTML-encode GenAI outputs before rendering in web UIs.
-2. Use parameterized queries when GenAI output is used in database operations.
-3. JSON-encode outputs before embedding in JavaScript contexts.
-4. Validate output length and format before passing to downstream APIs.</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-57</code></td>
-            <td class="col-domain">ADVISORY: Output Encoding — Manual Review Required</td>
-            <td class="finding-details">Output encoding practices cannot be verified via AWS APIs. Manual code review required.</td>
-            <td class="resolution-text">1. HTML-encode GenAI outputs before rendering in web UIs.
-2. Use parameterized queries when GenAI output is used in database operations.
-3. JSON-encode outputs before embedding in JavaScript contexts.
-4. Validate output length and format before passing to downstream APIs.</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-58</code></td>
-            <td class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</td>
-            <td class="finding-details">Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</td>
-            <td class="resolution-text">1. Use Bedrock structured output (response schemas) where supported.
-2. Implement JSON schema validation on Lambda output processors.
-3. Reject malformed outputs and return safe error responses.
-4. Log schema validation failures to CloudWatch for monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-58</code></td>
-            <td class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</td>
-            <td class="finding-details">Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</td>
-            <td class="resolution-text">1. Use Bedrock structured output (response schemas) where supported.
-2. Implement JSON schema validation on Lambda output processors.
-3. Reject malformed outputs and return safe error responses.
-4. Log schema validation failures to CloudWatch for monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-59</code></td>
-            <td class="col-domain">Topic Restrictions Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only; the STANDARD tier (GA June 2025) adds broader language support for off-topic detection.</td>
-            <td class="resolution-text">For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-59</code></td>
-            <td class="col-domain">Topic Restrictions Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only; the STANDARD tier (GA June 2025) adds broader language support for off-topic detection.</td>
-            <td class="resolution-text">For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-60</code></td>
-            <td class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</td>
-            <td class="finding-details">Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</td>
-            <td class="resolution-text">1. Include explicit scope instructions in system prompts.
-2. Use Bedrock Guardrails relevance grounding filter.
-3. Test with off-topic prompts in QA to verify rejection behavior.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-60</code></td>
-            <td class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</td>
-            <td class="finding-details">Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</td>
-            <td class="resolution-text">1. Include explicit scope instructions in system prompts.
-2. Use Bedrock Guardrails relevance grounding filter.
-3. Test with off-topic prompts in QA to verify rejection behavior.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-61</code></td>
-            <td class="col-domain">No Automated KB Sync Schedules Detected</td>
-            <td class="finding-details">Found 3 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</td>
-            <td class="resolution-text">1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
-2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
-3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
-4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-61</code></td>
-            <td class="col-domain">No Automated KB Sync Schedules Detected</td>
-            <td class="finding-details">Found 3 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</td>
-            <td class="resolution-text">1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
-2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
-3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
-4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-62</code></td>
-            <td class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
-2. Expose KB last sync timestamp in application responses.
-3. Alert users when KB data is older than defined threshold.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-62</code></td>
-            <td class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
-2. Expose KB last sync timestamp in application responses.
-3. Alert users when KB data is older than defined threshold.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-63</code></td>
-            <td class="col-domain">Foundation Model Lifecycle Management</td>
-            <td class="finding-details">No legacy models detected. 10 lifecycle-related Config rule(s) found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-63</code></td>
-            <td class="col-domain">Foundation Model Lifecycle Management</td>
-            <td class="finding-details">No legacy models detected. 10 lifecycle-related Config rule(s) found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-65</code></td>
-            <td class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</td>
-            <td class="finding-details">The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
-- semiconductor-demo-9999
-- 111122223333-us-east-1-kb-data-bucket</td>
-            <td class="resolution-text">1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
-2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
-3. Integrate alerts into your security incident response workflow.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-65</code></td>
-            <td class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</td>
-            <td class="finding-details">The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
-- semiconductor-demo-9999
-- 111122223333-us-east-1-kb-data-bucket</td>
-            <td class="resolution-text">1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
-2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
-3. Integrate alerts into your security incident response workflow.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-66</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing End-User Identity Propagation</td>
-            <td class="finding-details">The following runtimes have no JWT or IAM authorizer configured for end-user identity propagation. Tool calls are authorized only by the agent execution role, not the originating user:
-- origami_expeditions
-- neoCyan_Agent
-- customer_support_agent
-- cdk_agent_core
-- awsapimcpserver</td>
-            <td class="resolution-text">1. Configure a custom JWT authorizer or IAM authorizer on each AgentCore runtime.
-2. Propagate the end-user's identity token to downstream tool services.
-3. Ensure tool services validate the propagated identity before executing actions.
-4. Do not expose propagated identity tokens to unauthorized third parties.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-66</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing End-User Identity Propagation</td>
-            <td class="finding-details">The following runtimes have no JWT or IAM authorizer configured for end-user identity propagation. Tool calls are authorized only by the agent execution role, not the originating user:
-- origami_expeditions
-- neoCyan_Agent
-- customer_support_agent
-- cdk_agent_core
-- awsapimcpserver</td>
-            <td class="resolution-text">1. Configure a custom JWT authorizer or IAM authorizer on each AgentCore runtime.
-2. Propagate the end-user's identity token to downstream tool services.
-3. Ensure tool services validate the propagated identity before executing actions.
-4. Do not expose propagated identity tokens to unauthorized third parties.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-67</code></td>
-            <td class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</td>
-            <td class="finding-details">The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
-- aiml-security-aiml-security-111122223333-FinServAssessment
-- aiml-security-aiml-security-111122223333-BedrockAssessment
-- resco-aiml-BedrockAssessment
-- aiml-security-aiml-security-111122223333-AgentCoreAssessment
-- e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk
-- e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII
-- resco-aiml-AgentCoreAssessment</td>
-            <td class="resolution-text">1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
-2. Implement threshold enforcement logic in the Lambda handler.
-3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
-4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-67</code></td>
-            <td class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</td>
-            <td class="finding-details">The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
-- aiml-security-aiml-security-111122223333-FinServAssessment
-- aiml-security-aiml-security-111122223333-BedrockAssessment
-- resco-aiml-BedrockAssessment
-- aiml-security-aiml-security-111122223333-AgentCoreAssessment
-- e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk
-- e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII
-- resco-aiml-AgentCoreAssessment</td>
-            <td class="resolution-text">1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
-2. Implement threshold enforcement logic in the Lambda handler.
-3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
-4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-68</code></td>
-            <td class="col-domain">API Gateway Request Body Size Limits Not Enforced</td>
-            <td class="finding-details">Found 3 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Add a maxLength (or maxItems/maxProperties) bound to the request-body JSON-Schema model used by your request validator, so oversized prompts are rejected with a 400.
-2. Add a WAF SizeConstraintStatement on the request Body sized within WAF's body-inspection window (default 16 KB; raise via the web ACL AssociationConfig, or set OversizeHandling=MATCH to block bodies beyond the window), and associate the ACL with the API stage.
-3. Set the max_tokens parameter in Bedrock API calls to cap output length.
-4. Implement client-side token counting before submitting requests.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-68</code></td>
-            <td class="col-domain">API Gateway Request Body Size Limits Not Enforced</td>
-            <td class="finding-details">Found 3 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Add a maxLength (or maxItems/maxProperties) bound to the request-body JSON-Schema model used by your request validator, so oversized prompts are rejected with a 400.
-2. Add a WAF SizeConstraintStatement on the request Body sized within WAF's body-inspection window (default 16 KB; raise via the web ACL AssociationConfig, or set OversizeHandling=MATCH to block bodies beyond the window), and associate the ACL with the API stage.
-3. Set the max_tokens parameter in Bedrock API calls to cap output length.
-4. Implement client-side token counting before submitting requests.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-69</code></td>
-            <td class="col-domain">Prompt Input Validation Functions Present</td>
-            <td class="finding-details">Found 3 Lambda function(s) with input validation/sanitization naming patterns: resco-aiml-CleanupBucket, visa-bulletin-tracker-prod-cleanup, aiml-security-aiml-security-111122223333-CleanupBucket.</td>
-            <td class="resolution-text">Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-69</code></td>
-            <td class="col-domain">Prompt Input Validation Functions Present</td>
-            <td class="finding-details">Found 3 Lambda function(s) with input validation/sanitization naming patterns: resco-aiml-CleanupBucket, visa-bulletin-tracker-prod-cleanup, aiml-security-aiml-security-111122223333-CleanupBucket.</td>
-            <td class="resolution-text">Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">No roles found with AmazonBedrockFullAccess policy</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">No identities found with overly permissive marketplace subscription access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Run assessment in management account to check cross-account guardrails enforcement</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Full Access Check</td>
-            <td class="finding-details">No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Stale Access</td>
-            <td class="finding-details">The following principals have not accessed AgentCore in 60+ days: role 'resco-aiml-security-23026-AgentCoreSecurityAssessme-2AEt2MTxg4AU' (82 days)</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have not accessed AgentCore in 60+ days: role 'resco-aiml-security-23026-AgentCoreSecurityAssessme-2AEt2MTxg4AU' (82 days)</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker IAM Permissions Check</td>
-            <td class="finding-details">No issues found with IAM permissions and no stale access detected</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">AWS Shield Advanced Not Enabled</td>
-            <td class="finding-details">AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Subscribe to AWS Shield Advanced for DDoS protection.
-2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
-3. Enable Shield Response Team (SRT) access and configure proactive engagement.
-4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">No Regional WAF Web ACLs Found</td>
-            <td class="finding-details">No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</td>
-            <td class="resolution-text">1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
-2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
-3. Add AWS Managed Rules for known bad inputs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-02</code></td>
-            <td class="col-domain">No API Gateway Usage Plans Found</td>
-            <td class="finding-details">No usage plans configured. GenAI API endpoints may have no rate limits.</td>
-            <td class="resolution-text">Create API Gateway usage plans with throttle settings (rateLimit and burstLimit) for all Bedrock-facing APIs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-03</code></td>
-            <td class="col-domain">Bedrock Token Quotas Customized</td>
-            <td class="finding-details">Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</td>
-            <td class="resolution-text">No action required. Periodically re-review quotas against expected peak load.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-04</code></td>
-            <td class="col-domain">No Cost Anomaly Detection Monitors</td>
-            <td class="finding-details">No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</td>
-            <td class="resolution-text">1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
-2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
-3. Set daily spend budgets with AWS Budgets as a secondary control.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-05</code></td>
-            <td class="col-domain">No Bedrock CloudWatch Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms for:
-- AWS/Bedrock InvocationThrottles (threshold > 0)
-- AWS/Bedrock TokensProcessed (threshold based on quota)
-- Custom application-level token counters via EMF</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-06</code></td>
-            <td class="col-domain">No AI/ML Service Budgets Configured</td>
-            <td class="finding-details">No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</td>
-            <td class="resolution-text">1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
-2. Add SNS notifications to on-call channels.
-3. Consider budget actions to apply IAM deny policies when thresholds are breached.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-07</code></td>
-            <td class="col-domain">Agent Action Boundaries Look Appropriate</td>
-            <td class="finding-details">Reviewed 1 agent(s); no wildcard sensitive actions found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-08</code></td>
-            <td class="col-domain">No AgentCore Runtimes Found</td>
-            <td class="finding-details">No AgentCore runtimes found; policy engine check not applicable.</td>
-            <td class="resolution-text">If using AgentCore, configure the Policy Engine to authorize tool calls.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-09</code></td>
-            <td class="col-domain">Agent Lambda Functions Without Concurrency Limits</td>
-            <td class="finding-details">Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-mgmt-FinServAssessment, aiml-sec-test-resources-SageMakerJobCustomResource-ZA5QCAi0pN3d, AIMLSecurityAssessment-CodeBuildStartBuildLambda-VYOqtzWoNo3m, aiml-security-aiml-security-mgmt-CleanupBucket, aiml-security-aiml-security-mgmt-SagemakerAssessment, aiml-security-aiml-security-mgmt-GenerateReport, aiml-security-aiml-security-mgmt-IAMPermissionCaching, aiml-security-aiml-security-mgmt-AgentCoreAssessment, aiml-security-aiml-security-mgmt-BedrockAssessment, aiml-security-aiml-security-mgmt-ResolveRegions. Unlimited concurrency allows runaway agent loops to exhaust account limits.</td>
-            <td class="resolution-text">1. Set reserved concurrency on agent Lambda functions.
-2. Implement maximum iteration counts in agent orchestration logic.
-3. Use Step Functions with MaxConcurrency and timeout states.
-4. Add circuit-breaker patterns to agent tool invocations.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-10</code></td>
-            <td class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</td>
-            <td class="finding-details">No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</td>
-            <td class="resolution-text">Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-11</code></td>
-            <td class="col-domain">No Agent Rate Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms on:
-- Bedrock agent invocation counts (threshold based on expected max)
-- Lambda invocation errors for agent functions
-- Step Functions execution failures and timeouts</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-12</code></td>
-            <td class="col-domain">No Bedrock-Scoped SCPs Found</td>
-            <td class="finding-details">No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</td>
-            <td class="resolution-text">1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
-2. Use bedrock:ModelId condition key to allowlist approved models.
-3. Maintain a model inventory and update the SCP when models are approved/retired.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-13</code></td>
-            <td class="col-domain">Models Missing Provenance Tags</td>
-            <td class="finding-details">2 model(s) missing required provenance tags:
-- SageMaker model 'SageMakerModelWithIsolation-JASFpUHjajdk' missing tags: {'version', 'approval-date', 'source'}
-- SageMaker model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' missing tags: {'version', 'approval-date', 'source'}</td>
-            <td class="resolution-text">Tag all models with: source (e.g., 'aws-marketplace', 'internal'), version, and approval-date. Enforce tagging via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-14</code></td>
-            <td class="col-domain">Model Governance Config Rules Present</td>
-            <td class="finding-details">Found 13 model-related Config rule(s).</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-15</code></td>
-            <td class="col-domain">No Bedrock Evaluation Jobs Found</td>
-            <td class="finding-details">No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</td>
-            <td class="resolution-text">1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
-2. Use FMEval library for automated robustness testing.
-3. Schedule periodic re-evaluation after model updates.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-16</code></td>
-            <td class="col-domain">ECR Repositories Without Image Scanning</td>
-            <td class="finding-details">2 ECR repo(s) without scan-on-push: cdk-hnb659fds-container-assets-777788889999-us-east-1, aiml-sec-test-agentcore-no-encryption.</td>
-            <td class="resolution-text">Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-20</code></td>
-            <td class="col-domain">Feature Groups Without Offline Store</td>
-            <td class="finding-details">1 feature group(s) lack an active offline store: aiml-sec-test-feature-group. Without offline store, historical feature data cannot be used for rollback.</td>
-            <td class="resolution-text">1. Enable offline store (S3-backed) for all production feature groups.
-2. Enable S3 versioning on the offline store bucket.
-3. Document rollback procedures for poisoned feature data.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-offline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-21</code></td>
-            <td class="col-domain">Training Data Buckets Have Versioning</td>
-            <td class="finding-details">All 2 training bucket(s) have versioning enabled.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-22</code></td>
-            <td class="col-domain">Overly Permissive Knowledge Base IAM Roles</td>
-            <td class="finding-details">823 role(s) with wildcard KB permissions:
-- Role 'Admin' allows '*'
-- Role 'aiml-sec-test-resources-BedrockAgentRole-RScmoTZfp2sC' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockAgentRole-RScmoTZfp2sC' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' allows 'bedrock:*'
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:GetModelInvocationLoggingConfiguration' on Resource '*' (no ARN scoping to specific Knowledge Bases)</td>
-            <td class="resolution-text">Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-24</code></td>
-            <td class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</td>
-            <td class="finding-details">Found 1 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</td>
-            <td class="resolution-text">1. Add metadata fields (tenantId, dataClassification) to KB data sources.
-2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
-3. Validate filters in integration tests to prevent cross-tenant data leakage.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-25</code></td>
-            <td class="col-domain">OpenSearch Serverless Encryption Policies Present</td>
-            <td class="finding-details">Found 1 encryption policy(ies); 1 use a customer-managed KMS key.</td>
-            <td class="resolution-text">Verify all vector store collections use customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-26</code></td>
-            <td class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</td>
-            <td class="finding-details">Found 1 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</td>
-            <td class="resolution-text">Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">No Automated Reasoning Policies Found</td>
-            <td class="finding-details">No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</td>
-            <td class="resolution-text">1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
-2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
-3. Set confidenceThreshold on the policy to control strictness.
-4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
-5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-28</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Financial Denied Topics Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-29</code></td>
-            <td class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</td>
-            <td class="resolution-text">1. Implement post-processing to append required disclaimers to GenAI outputs.
-2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
-3. Document disclaimer requirements in the AI use case register.
-4. Test disclaimer presence in QA/UAT before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-30</code></td>
-            <td class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with compliance-specific datasets:
-- Fair lending test cases (ECOA, Fair Housing Act)
-- UDAP/UDAAP unfair/deceptive practice scenarios
-- AML/KYC edge cases</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-31</code></td>
-            <td class="col-domain">Knowledge Base Data Sources Past Review Threshold</td>
-            <td class="finding-details">1 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
-- KB 'knowledge-base-prowler-findings' source 'knowledge-base-quick-start-9lb68-data-source' last synced 423 days ago
-Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</td>
-            <td class="resolution-text">1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
-2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
-3. Set CloudWatch alarms on sync job failures.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-32</code></td>
-            <td class="col-domain">ADVISORY: Source Attribution — Manual Review Required</td>
-            <td class="finding-details">Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</td>
-            <td class="resolution-text">1. Use Bedrock RetrieveAndGenerate with citations enabled.
-2. Include source document references in response post-processing.
-3. Test citation accuracy in QA before production deployment.
-4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-33</code></td>
-            <td class="col-domain">KB Data Source Buckets Have Versioning</td>
-            <td class="finding-details">All reviewed KB data source buckets have versioning enabled.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-34</code></td>
-            <td class="col-domain">Legacy Foundation Models Available in Region</td>
-            <td class="finding-details">Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</td>
-            <td class="resolution-text">1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
-2. Migrate active usage to current model versions.
-3. Document training-data cutoff dates for all models in use.
-4. Add data-currency disclaimers to outputs from models with old cutoffs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-35</code></td>
-            <td class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation or FMEval with harmful content datasets:
-- Toxicity detection
-- Hate speech classification
-- Violence/self-harm content</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-36</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Content Filters Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-37</code></td>
-            <td class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</td>
-            <td class="finding-details">User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
-2. Route flagged outputs to human reviewers via SQS/SNS.
-3. Log feedback to DynamoDB/S3 for model improvement.
-4. Define SLAs for reviewing flagged content.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-38</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Word Filters Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-39</code></td>
-            <td class="col-domain">No SageMaker Clarify Bias Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
-2. Define protected attributes (age, gender, race proxies).
-3. Set bias metric thresholds and alert on violations.
-4. Document bias testing results for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-40</code></td>
-            <td class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with bias test datasets:
-- Demographic parity test cases
-- Equal opportunity scenarios
-- Counterfactual fairness tests</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-41</code></td>
-            <td class="col-domain">No SageMaker Clarify Explainability Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify explainability for credit/lending models.
-2. Generate SHAP values for feature importance.
-3. Map top features to human-readable adverse action reason codes.
-4. Store explanations for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-42</code></td>
-            <td class="col-domain">No SageMaker Model Cards Found</td>
-            <td class="finding-details">No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</td>
-            <td class="resolution-text">1. Create SageMaker Model Cards for all production models.
-2. Document: intended use, out-of-scope uses, training data, bias evaluations.
-3. Include regulatory compliance attestations.
-4. Review and update cards at each model version release.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-43</code></td>
-            <td class="col-domain">No CloudWatch Logs Data Protection Policies</td>
-            <td class="finding-details">No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</td>
-            <td class="resolution-text">1. Create CloudWatch Logs data protection policies to mask PII.
-2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
-3. Apply policies to Bedrock invocation log groups.
-4. Test masking with synthetic PII before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-44</code></td>
-            <td class="col-domain">Amazon Macie Not Enabled</td>
-            <td class="finding-details">Amazon Macie is not enabled. S3 buckets containing training data and KB data sources are not being scanned for PII/sensitive data.</td>
-            <td class="resolution-text">1. Enable Amazon Macie in all regions where AI/ML data is stored.
-2. Create Macie classification jobs for training data and KB buckets.
-3. Configure Macie findings to route to Security Hub and SNS.
-4. Remediate PII findings before using data for model training.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-45</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail PII Filters Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-46</code></td>
-            <td class="col-domain">AI/ML Buckets Without Data Classification Tags</td>
-            <td class="finding-details">3 AI/ML bucket(s) without data-classification tags: aiml-sec-test-resources-bedrockloggingbucket-wtuvpinrlpmd, aiml-sec-test-resources-sagemakerbucket-6zzmxxaxco6g, aiml-security-mgmt-aimlassessmentbucket-kbitsdgexylv.</td>
-            <td class="resolution-text">Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-47</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Grounding Threshold Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-48</code></td>
-            <td class="col-domain">Active Knowledge Bases for RAG Present</td>
-            <td class="finding-details">Found 1 active Knowledge Base(s) for RAG grounding.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-49</code></td>
-            <td class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
-2. Implement post-processing to append disclaimers.
-3. Test disclaimer presence in QA before production.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-50</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Relevance Grounding Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-51</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Prompt Injection Input Validation Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-52</code></td>
-            <td class="col-domain">Bedrock Lambda Functions on Current Runtimes</td>
-            <td class="finding-details">All 10 Bedrock Lambda function(s) use current runtimes.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-53</code></td>
-            <td class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF Web ACLs with injection protection rules (see FS-01).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-54</code></td>
-            <td class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</td>
-            <td class="finding-details">Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</td>
-            <td class="resolution-text">1. Conduct penetration testing of GenAI applications at least annually and before major releases.
-2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
-3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
-4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
-5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-55</code></td>
-            <td class="col-domain">No Output Validation Functions Found</td>
-            <td class="finding-details">No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</td>
-            <td class="resolution-text">1. Implement output validation Lambda functions in GenAI pipelines.
-2. Validate output schema, length, and content before downstream use.
-3. Sanitize outputs before rendering in web UIs (XSS prevention).
-4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-56</code></td>
-            <td class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF ACLs with XSS prevention rules.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-57</code></td>
-            <td class="col-domain">ADVISORY: Output Encoding — Manual Review Required</td>
-            <td class="finding-details">Output encoding practices cannot be verified via AWS APIs. Manual code review required.</td>
-            <td class="resolution-text">1. HTML-encode GenAI outputs before rendering in web UIs.
-2. Use parameterized queries when GenAI output is used in database operations.
-3. JSON-encode outputs before embedding in JavaScript contexts.
-4. Validate output length and format before passing to downstream APIs.</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-58</code></td>
-            <td class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</td>
-            <td class="finding-details">Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</td>
-            <td class="resolution-text">1. Use Bedrock structured output (response schemas) where supported.
-2. Implement JSON schema validation on Lambda output processors.
-3. Reject malformed outputs and return safe error responses.
-4. Log schema validation failures to CloudWatch for monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-59</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Topic Allowlist Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-60</code></td>
-            <td class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</td>
-            <td class="finding-details">Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</td>
-            <td class="resolution-text">1. Include explicit scope instructions in system prompts.
-2. Use Bedrock Guardrails relevance grounding filter.
-3. Test with off-topic prompts in QA to verify rejection behavior.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-61</code></td>
-            <td class="col-domain">No Automated KB Sync Schedules Detected</td>
-            <td class="finding-details">Found 1 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</td>
-            <td class="resolution-text">1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
-2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
-3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
-4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-62</code></td>
-            <td class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
-2. Expose KB last sync timestamp in application responses.
-3. Alert users when KB data is older than defined threshold.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-63</code></td>
-            <td class="col-domain">Foundation Model Lifecycle Management</td>
-            <td class="finding-details">No legacy models detected. 11 lifecycle-related Config rule(s) found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-65</code></td>
-            <td class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</td>
-            <td class="finding-details">The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
-- sat2-prowler-2025-prowlerfindingsbucket-wc1k0mza7lpk</td>
-            <td class="resolution-text">1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
-2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
-3. Integrate alerts into your security incident response workflow.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-66</code></td>
-            <td class="col-domain">No AgentCore Runtimes Found</td>
-            <td class="finding-details">No AgentCore runtimes found; identity propagation check not applicable.</td>
-            <td class="resolution-text">If using AgentCore, configure token propagation so end-user identities are forwarded to tool services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-67</code></td>
-            <td class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</td>
-            <td class="finding-details">The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
-- aiml-security-aiml-security-mgmt-FinServAssessment
-- aiml-security-aiml-security-mgmt-AgentCoreAssessment
-- aiml-security-aiml-security-mgmt-BedrockAssessment</td>
-            <td class="resolution-text">1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
-2. Implement threshold enforcement logic in the Lambda handler.
-3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
-4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-68</code></td>
-            <td class="col-domain">API Gateway Request Body Size Limits — Not Applicable</td>
-            <td class="finding-details">No API Gateway REST APIs and no regional WAF Web ACLs were found in this region. There is no input-payload surface to assess for body-size limits.</td>
-            <td class="resolution-text">If GenAI endpoints are fronted by API Gateway or WAF in another region, run the assessment there. Otherwise no action is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-size-constraint.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-69</code></td>
-            <td class="col-domain">Prompt Input Validation Functions Present</td>
-            <td class="finding-details">Found 1 Lambda function(s) with input validation/sanitization naming patterns: aiml-security-aiml-security-mgmt-CleanupBucket.</td>
-            <td class="resolution-text">Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Wildcard Permissions</td>
-            <td class="finding-details">The following roles have wildcard AgentCore permissions on all resources: aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV</td>
-            <td class="resolution-text">Scope permissions to specific AgentCore resources using resource ARNs</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV', role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore ECR Repository AWS-Managed Keys</td>
-            <td class="finding-details">ECR repository 'aiml-sec-test-agentcore-no-encryption' uses AWS-managed keys instead of customer-managed KMS keys</td>
-            <td class="resolution-text">Consider using customer-managed KMS keys for better control and audit capabilities</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have wildcard AgentCore permissions on all resources: aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV', role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-SageMakerFullAccessRole-ZREdSNCErx2S' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Direct Internet Access Enabled</td>
-            <td class="finding-details">SageMaker notebook instance 'aiml-sec-test-notebook-with-internet' has direct internet access enabled</td>
-            <td class="resolution-text">Configure the notebook instance to use VPC connectivity and disable direct internet access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-ilmtsfeenavc' (aiml-sec-test-domain-fail-028e1010-52cbf970) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-cmz7ohkxxop3' (aiml-sec-test-domain-fail-fef4e7f0-bb429d11) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-7zl8skw96ppk' (aiml-sec-test-domain-pass-028e1010-3dba8b08) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-ilmtsfeenavc' (aiml-sec-test-domain-fail-028e1010-52cbf970) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-uqjoi05f0zzp' (aiml-sec-test-domain-pass-fef4e7f0-51d1e898) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-cmz7ohkxxop3' (aiml-sec-test-domain-fail-fef4e7f0-bb429d11) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Notebook Instance 'aiml-sec-test-notebook-with-internet' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'aiml-sec-test-domain-fail-028e1010-52cbf970' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'aiml-sec-test-domain-fail-fef4e7f0-bb429d11' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Training Job 'aiml-sec-test-training-no-encryption-028e1010-e2fb8765' - No output encryption configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing VPC Encryption</td>
-            <td class="finding-details">Training Job 'aiml-sec-test-training-no-encryption-028e1010-e2fb8765' - Inter-container traffic encryption not enabled</td>
-            <td class="resolution-text">Enable encryption for inter-container traffic and VPC communication</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-in-transit.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">Model group 'aiml-sec-test-model-package-group' has minimal versioning</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Empty Model Group</td>
-            <td class="finding-details">Model group aiml-sec-test-model-package-group has no registered models</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Enabled</td>
-            <td class="finding-details">Notebook instance 'aiml-sec-test-notebook-with-internet' has root access enabled. Root access allows users to install arbitrary software, modify system configurations, and potentially escalate privileges.</td>
-            <td class="resolution-text">Disable root access by updating the notebook instance with RootAccess=Disabled. Note: Lifecycle configurations will still run with root access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook Not in VPC</td>
-            <td class="finding-details">Notebook instance 'aiml-sec-test-notebook-with-internet' is not deployed in a custom VPC. This uses SageMaker's service VPC with reduced network isolation.</td>
-            <td class="resolution-text">Create the notebook instance within a custom VPC by specifying SubnetId and SecurityGroupIds. This provides network isolation and allows use of VPC endpoints.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Disabled</td>
-            <td class="finding-details">Model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' does not have network isolation enabled. Model containers can make outbound network calls, potentially exfiltrating data.</td>
-            <td class="resolution-text">Enable network isolation by setting EnableNetworkIsolation=True when creating models. This prevents containers from making outbound network calls.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Platform Repository Access</td>
-            <td class="finding-details">Model 'SageMakerModelWithIsolation-JASFpUHjajdk' uses Platform repository access mode. Container images are pulled from public/external registries, exposing supply chain risks.</td>
-            <td class="resolution-text">Configure RepositoryAccessMode=Vpc in ImageConfig to pull images from private ECR repositories through VPC. This provides supply chain security.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Platform Repository Access</td>
-            <td class="finding-details">Model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' uses Platform repository access mode. Container images are pulled from public/external registries, exposing supply chain risks.</td>
-            <td class="resolution-text">Configure RepositoryAccessMode=Vpc in ImageConfig to pull images from private ECR repositories through VPC. This provides supply chain security.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Offline Encryption Missing</td>
-            <td class="finding-details">Feature group 'aiml-sec-test-feature-group' offline store does not have KMS encryption configured. Feature data in S3 may not be encrypted with customer-managed keys.</td>
-            <td class="resolution-text">Configure KmsKeyId in OfflineStoreConfig.S3StorageConfig when creating feature groups to encrypt offline store data with customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">All 1 processing jobs have volume encryption configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">All 1 transform jobs have volume encryption configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">Checked 1 model package groups. Approval workflows appear to be properly configured.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-MarketplaceOverlyPermissive-igL3hGIapee1' has overly permissive marketplace subscription access through policy 'OverlyPermissiveMarketplace'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'ProwlerApp-EC2-Role' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkMulticontainerDocker'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity</td>
-            <td class="finding-details">Bedrock VPC endpoints found: VPC vpc-089a9d593e34658c6 has endpoint com.amazonaws.us-east-1.bedrock-runtime</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable model invocation logging to collect invocation logs, model input data, and model output data. Configure logging to deliver to Amazon S3, CloudWatch Logs, or both for comprehensive monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">Amazon Bedrock Guardrails are properly configured with 1 guardrails</td>
-            <td class="resolution-text">No action required. Continue monitoring and updating guardrails as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">No action required. Continue monitoring CloudTrail logs for Bedrock activity.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management is being used with 1 prompts</td>
-            <td class="resolution-text">No action required. Continue using Prompt Management for consistent and optimized prompts.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">Error during check: An error occurred (AccessDeniedException) when calling the GetAgent operation: You do not have sufficient permissions to the key. Check credentials for appropriate permissions to the key (kms:Decrypt, kms:GenerateDataKey) and try again.</td>
-            <td class="resolution-text">Investigate error and retry assessment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-prowler-findings' (9K2QZLVCZW) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Missing</td>
-            <td class="finding-details">The following roles can invoke Bedrock models without enforced guardrails: aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G, aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a, aiml-sec-test-resources-BedrockKnowledgeBaseRole-6NNC1i9FuTbM, AmazonBedrockExecutionRoleForKnowledgeBase_7erx6, ProwlerApp-EC2-Role</td>
-            <td class="resolution-text">Add IAM policy conditions to enforce guardrail usage:
-1. Use 'bedrock:GuardrailIdentifier' condition key
-2. Specify required guardrail ARN or ID
-3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Run assessment in management account to check cross-account guardrails enforcement</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-prowler-findings' (ID: 9K2QZLVCZW) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">9 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-prowler-findings' (ID: 9K2QZLVCZW) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">1 agents have an associated guardrail</td>
-            <td class="resolution-text">No action required. Continue associating guardrails with new agents.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 9 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: 1 agents have an associated guardrail</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="risk" class="section">
-                <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>Risk Distribution</div>
-                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Pass Rate by Severity</h4>
-                <div class="metrics" style="margin-bottom: 32px;">
-                    <div class="metric danger"><div class="metric-label"><span class="severity high" style="padding: 2px 6px; font-size: 10px;">HIGH</span></div><div class="metric-value">12.8%</div><div class="metric-sub">28 of 219 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 12.8%; height: 100%; background: var(--danger);"></div></div></div>
-                    <div class="metric warning"><div class="metric-label"><span class="severity medium" style="padding: 2px 6px; font-size: 10px;">MEDIUM</span></div><div class="metric-value">29.3%</div><div class="metric-sub">82 of 280 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 29.3%; height: 100%; background: var(--warning);"></div></div></div>
-                    <div class="metric" style="border-color: var(--accent);"><div class="metric-label"><span class="severity low" style="padding: 2px 6px; font-size: 10px;">LOW</span></div><div class="metric-value" style="color: var(--accent);">30.3%</div><div class="metric-sub">30 of 99 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 30.3%; height: 100%; background: var(--accent);"></div></div></div>
-                    <div class="metric"><div class="metric-label">Overall</div><div class="metric-value">23.4%</div><div class="metric-sub">140 of 598 actionable checks</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 23.4%; height: 100%; background: var(--text-3);"></div></div></div>
-                </div>
-                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Account</h4>
-                <div class="metrics" style="margin-bottom: 32px;"><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">111122223333</div><div class="metric-value">193</div><div class="metric-sub"><span style="color: var(--danger);">78 High</span> · <span style="color: var(--warning);">95 Med</span> · <span style="color: var(--accent);">20 Low</span></div></div><div class="metric warning" style="border-left: 3px solid var(--warning);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">444455556666</div><div class="metric-value">3</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">3 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">777788889999</div><div class="metric-value">64</div><div class="metric-sub"><span style="color: var(--danger);">28 High</span> · <span style="color: var(--warning);">31 Med</span> · <span style="color: var(--accent);">5 Low</span></div></div></div>
-                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Region</h4>
-                <div class="metrics" style="margin-bottom: 32px;"><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">ap-south-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">eu-west-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">sa-east-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-east-1</div><div class="metric-value">157</div><div class="metric-sub"><span style="color: var(--danger);">52 High</span> · <span style="color: var(--warning);">90 Med</span> · <span style="color: var(--accent);">15 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-west-2</div><div class="metric-value">64</div><div class="metric-sub"><span style="color: var(--danger);">22 High</span> · <span style="color: var(--warning);">32 Med</span> · <span style="color: var(--accent);">10 Low</span></div></div></div>
-                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Findings by Assessment Area</h4>
-                <div class="metrics">
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span> Bedrock</div><div class="metric-value">461</div><div class="metric-sub">50 Failed · 18 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span> SageMaker</div><div class="metric-value">423</div><div class="metric-sub">34 Failed · 61 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span> AgentCore</div><div class="metric-value">182</div><div class="metric-sub">39 Failed · 3 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security</div><div class="metric-value">388</div><div class="metric-sub">47 Failed &middot; 18 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services Risk</div><div class="metric-value">210</div><div class="metric-sub">90 Failed · 40 Passed</div></div>
-                </div>
-            </section>
-            <section id="bedrock" class="section">
-                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>Amazon Bedrock Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="bedrockSearchInput"></div>
-                    <div class="filter-group"><label>Account</label><select id="bedrockAccountFilter"><option value="">All Accounts</option><option value="111122223333">111122223333</option><option value="444455556666">444455556666</option><option value="777788889999">777788889999</option></select></div>
-                    <div class="filter-group"><label for="bedrockRegionFilter">Region</label><select id="bedrockRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
-                    <div class="filter-group"><label>Severity</label><select id="bedrockSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="bedrockStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="bedrockResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="bedrockTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'myAskMeAnything-role-kmsizqwf' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-cdk_agent_core'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b' has overly permissive marketplace subscription access through policy 'BedrockAgentCoreRuntimeExecutionPolicy-neoCyan_Agent'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockExecutionRoleForKnowledgeBase_knnc9' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_knnc9'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonBedrockExecutionRoleForKnowledgeBase_qxqw2' has overly permissive marketplace subscription access through policy 'AmazonBedrockFoundationModelPolicyForKnowledgeBase_qxqw2'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'AmazonSageMaker-ExecutionRole-20250525T153161' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'myAskMeAnything-role-kmsizqwf' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">User 'BedrockAPIKey-20pp' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">User 'BedrockAPIKey-yhc3' has overly permissive marketplace subscription access through policy 'AmazonBedrockLimitedAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">User 'BedrockClientUser' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity not used</td>
-            <td class="finding-details">No Bedrock service VPC endpoints found in VPCs: vpc-03472be90d65c2f68, vpc-39319f44, vpc-064f3e808e378cbc8, vpc-02d020a365a06c7fe</td>
-            <td class="resolution-text">Create a VPC endpoint in your VPC with any of the following Bedrock service endpoints that your application may be using:
-- com.amazonaws.region.bedrock
-- com.amazonaws.region.bedrock-runtime
-- com.amazonaws.region.bedrock-agent
-- com.amazonaws.region.bedrock-agent-runtime</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">Model invocation logging is properly configured with delivery to: Amazon S3, CloudWatch Logs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">Amazon Bedrock Guardrails are properly configured with 1 guardrails</td>
-            <td class="resolution-text">No action required. Continue monitoring and updating guardrails as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">No action required. Continue monitoring CloudTrail logs for Bedrock activity.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-semiconductors' (RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base '111122223333-us-east-1-kb' (PAJOKBSIMQ) uses 'S3_VECTORS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'e2e-rag-knowledgebase' (ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Missing</td>
-            <td class="finding-details">The following roles can invoke Bedrock models without enforced guardrails: 111122223333-us-east-1-kb-bedrock-service-role, agentcore-wildrydes_gateway_role_ab3991f6-role, AgentCoreEvalsSDK-us-east-1-d04ba7b68b, AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76, AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b, AmazonBedrockExecutionRoleForAgents_S0T9VNPP9D, AmazonBedrockExecutionRoleForAgents_WNCOPE29NZ, AmazonBedrockExecutionRoleForKnowledgeBase_072pr, AmazonBedrockExecutionRoleForKnowledgeBase_byjin, AmazonBedrockExecutionRoleForKnowledgeBase_h9718...</td>
-            <td class="resolution-text">Add IAM policy conditions to enforce guardrail usage:
-1. Use 'bedrock:GuardrailIdentifier' condition key
-2. Specify required guardrail ARN or ID
-3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption</td>
-            <td class="finding-details">S3 bucket 'nistairmfguardrail-invocationlogsbucket8fe5371b-wmlsng7pkyhm' for invocation logs uses SSE-S3 encryption instead of customer-managed KMS. Invocation logs may contain sensitive prompts and responses.</td>
-            <td class="resolution-text">1. Enable SSE-KMS with a customer-managed key on the S3 bucket
-2. Update bucket policy to require encrypted uploads
-3. Consider enabling S3 bucket versioning and MFA delete for log integrity</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Run assessment in management account to check cross-account guardrails enforcement</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) is using the 'CLASSIC' content-filter tier instead of 'STANDARD'. The STANDARD tier provides more robust content filtering and broader language support than the CLASSIC tier.</td>
-            <td class="resolution-text">Update the guardrail to use the STANDARD content-filter tier for improved contextual understanding, better prompt attack filtering (distinguishing jailbreaks from prompt injection), and broader language support. The STANDARD tier requires cross-Region inference. Review pricing implications before upgrading.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">11 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">1 guardrails have complete content filter coverage (hate, insults, sexual, violence)</td>
-            <td class="resolution-text">No action required. Continue monitoring filter effectiveness and adjust thresholds as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure Automated Reasoning policies on guardrails to mathematically verify model responses. Define policies that specify allowed and disallowed behaviors. Use for high-assurance use cases where formal verification is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-semiconductors' (ID: RQYFDSE1LT) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base '111122223333-us-east-1-kb' (ID: PAJOKBSIMQ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'e2e-rag-knowledgebase' (ID: ESIYAYSYTJ) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">1 guardrails have sensitive-information (PII) filters configured</td>
-            <td class="resolution-text">No action required. Periodically review the PII entity types and regex patterns to ensure coverage matches your data.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">1 guardrails have contextual grounding checks enabled</td>
-            <td class="resolution-text">No action required. Review grounding and relevance thresholds periodically to balance hallucination detection against false positives.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity not used</td>
-            <td class="finding-details">No Bedrock service VPC endpoints found in VPCs: vpc-0f85a6754ab37efb7, vpc-5c3b6524, vpc-03bcafcb58a3029fc</td>
-            <td class="resolution-text">Create a VPC endpoint in your VPC with any of the following Bedrock service endpoints that your application may be using:
-- com.amazonaws.region.bedrock
-- com.amazonaws.region.bedrock-runtime
-- com.amazonaws.region.bedrock-agent
-- com.amazonaws.region.bedrock-agent-runtime</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable model invocation logging to collect invocation logs, model input data, and model output data. Configure logging to deliver to Amazon S3, CloudWatch Logs, or both for comprehensive monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">Amazon Bedrock Guardrails are properly configured with 1 guardrails</td>
-            <td class="resolution-text">No action required. Continue monitoring and updating guardrails as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">No action required. Continue monitoring CloudTrail logs for Bedrock activity.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-bedrock-agent' (XSPYLN4FQL) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (SUGAG7RGYD) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'promptfoo-rag-workshop-111122223333-kb' (N74ZIKTUFL) uses 'RDS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'InvestmentResearchKB' (M1GMUG3BP0) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-quick-start-xtwwd' (ENFHSBBLMV) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'kb-s3-vector-store' (116IXQU5VP) uses 'S3_VECTORS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Missing</td>
-            <td class="finding-details">The following roles can invoke Bedrock models without enforced guardrails: 111122223333-us-east-1-kb-bedrock-service-role, agentcore-wildrydes_gateway_role_ab3991f6-role, AgentCoreEvalsSDK-us-east-1-d04ba7b68b, AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76, AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b, AmazonBedrockExecutionRoleForAgents_S0T9VNPP9D, AmazonBedrockExecutionRoleForAgents_WNCOPE29NZ, AmazonBedrockExecutionRoleForKnowledgeBase_072pr, AmazonBedrockExecutionRoleForKnowledgeBase_byjin, AmazonBedrockExecutionRoleForKnowledgeBase_h9718...</td>
-            <td class="resolution-text">Add IAM policy conditions to enforce guardrail usage:
-1. Use 'bedrock:GuardrailIdentifier' condition key
-2. Specify required guardrail ARN or ID
-3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is using the 'CLASSIC' content-filter tier instead of 'STANDARD'. The STANDARD tier provides more robust content filtering and broader language support than the CLASSIC tier.</td>
-            <td class="resolution-text">Update the guardrail to use the STANDARD content-filter tier for improved contextual understanding, better prompt attack filtering (distinguishing jailbreaks from prompt injection), and broader language support. The STANDARD tier requires cross-Region inference. Review pricing implications before upgrading.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) uses 'RDS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) uses 'S3_VECTORS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">7 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is missing content filters: HATE, VIOLENCE, SEXUAL, INSULTS. Complete content filter coverage is essential for comprehensive content safety.</td>
-            <td class="resolution-text">Update guardrail to enable all content filters (HATE, INSULTS, SEXUAL, VIOLENCE). Configure appropriate threshold levels (LOW, MEDIUM, HIGH) for both input and output filtering based on your use case. Review AWS documentation for threshold guidance.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure Automated Reasoning policies on guardrails to mathematically verify model responses. Define policies that specify allowed and disallowed behaviors. Use for high-assurance use cases where formal verification is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-bedrock-agent' (ID: XSPYLN4FQL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'IDP-DOCUMENTBEDROCKKB-CY8N0Q7N4YDT' (ID: SUGAG7RGYD) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'promptfoo-rag-workshop-111122223333-kb' (ID: N74ZIKTUFL) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'InvestmentResearchKB' (ID: M1GMUG3BP0) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-quick-start-xtwwd' (ID: ENFHSBBLMV) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'kb-s3-vector-store' (ID: 116IXQU5VP) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) has no sensitive-information filters configured (no PII entities or regex patterns). Prompts and model responses are not screened for sensitive data such as PII.</td>
-            <td class="resolution-text">Configure sensitive-information filters on the guardrail: add PII entity types (e.g. NAME, EMAIL, SSN, CREDIT_DEBIT_CARD_NUMBER) and/or custom regex patterns, and set the appropriate BLOCK or ANONYMIZE action for input and output.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.</td>
-            <td class="resolution-text">Enable contextual grounding checks (GROUNDING and RELEVANCE filter types) on the guardrail with appropriate thresholds. This is especially important for RAG applications to ensure responses are grounded in the retrieved source material.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">No roles found with AmazonBedrockFullAccess policy</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">No identities found with overly permissive marketplace subscription access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Run assessment in management account to check cross-account guardrails enforcement</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' has AmazonBedrockFullAccess policy attached</td>
-            <td class="resolution-text">Limit the AmazonBedrockFullAccess policy only to required access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-MarketplaceOverlyPermissive-igL3hGIapee1' has overly permissive marketplace subscription access through policy 'OverlyPermissiveMarketplace'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'ProwlerApp-EC2-Role' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkMulticontainerDocker'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity</td>
-            <td class="finding-details">Bedrock VPC endpoints found: VPC vpc-089a9d593e34658c6 has endpoint com.amazonaws.us-east-1.bedrock-runtime</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable model invocation logging to collect invocation logs, model input data, and model output data. Configure logging to deliver to Amazon S3, CloudWatch Logs, or both for comprehensive monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">Amazon Bedrock Guardrails are properly configured with 1 guardrails</td>
-            <td class="resolution-text">No action required. Continue monitoring and updating guardrails as needed.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">No action required. Continue monitoring CloudTrail logs for Bedrock activity.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management is being used with 1 prompts</td>
-            <td class="resolution-text">No action required. Continue using Prompt Management for consistent and optimized prompts.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">Error during check: An error occurred (AccessDeniedException) when calling the GetAgent operation: You do not have sufficient permissions to the key. Check credentials for appropriate permissions to the key (kms:Decrypt, kms:GenerateDataKey) and try again.</td>
-            <td class="resolution-text">Investigate error and retry assessment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Review</td>
-            <td class="finding-details">Knowledge Base 'knowledge-base-prowler-findings' (9K2QZLVCZW) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: Verify encryption with CMK at collection level
-2. For S3 data sources: Verify CMK-encrypted S3 buckets
-3. For RDS: Verify KMS encryption on the database
-4. Consider using CMK for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Missing</td>
-            <td class="finding-details">The following roles can invoke Bedrock models without enforced guardrails: aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G, aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a, aiml-sec-test-resources-BedrockKnowledgeBaseRole-6NNC1i9FuTbM, AmazonBedrockExecutionRoleForKnowledgeBase_7erx6, ProwlerApp-EC2-Role</td>
-            <td class="resolution-text">Add IAM policy conditions to enforce guardrail usage:
-1. Use 'bedrock:GuardrailIdentifier' condition key
-2. Specify required guardrail ARN or ID
-3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Run assessment in management account to check cross-account guardrails enforcement</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-prowler-findings' (ID: 9K2QZLVCZW) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</td>
-            <td class="resolution-text">1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
-2. For Amazon RDS/Aurora: verify KMS encryption on the database
-3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
-4. Verify the customer-managed KMS key used for transient data during ingestion</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">9 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">Knowledge base 'knowledge-base-prowler-findings' (ID: 9K2QZLVCZW) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</td>
-            <td class="resolution-text">Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">1 agents have an associated guardrail</td>
-            <td class="resolution-text">No action required. Continue associating guardrails with new agents.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="sagemaker" class="section">
-                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span>Amazon SageMaker Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="sagemakerSearchInput"></div>
-                    <div class="filter-group"><label>Account</label><select id="sagemakerAccountFilter"><option value="">All Accounts</option><option value="111122223333">111122223333</option><option value="444455556666">444455556666</option><option value="777788889999">777788889999</option></select></div>
-                    <div class="filter-group"><label for="sagemakerRegionFilter">Region</label><select id="sagemakerRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
-                    <div class="filter-group"><label>Severity</label><select id="sagemakerSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="sagemakerStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="sagemakerResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="sagemakerTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'AmazonSageMaker-ExecutionRole-20231014T200029' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'AmazonSageMaker-ExecutionRole-20250525T153161' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'AmazonSageMakerServiceCatalogProductsExecutionRole' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'EMR_EC2_DefaultRole' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'IDPSageMakerCfnStack-SageMakerExecutionRole-aqrHz6dVkoHC' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'LLMEvaluationPromptfoo-SageMakerExecutionRole-M69xCHJ9c3LU' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'SageMaker-EMR-ExecutionRole' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-cz8qi7j81si3' (QuickSetupDomain-20250525T153160) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-cz8qi7j81si3' (QuickSetupDomain-20250525T153160) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'QuickSetupDomain-20250525T153160' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-krxh4fmtaxjl' (PromptEvaluationDomain) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-krxh4fmtaxjl' (PromptEvaluationDomain) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'PromptEvaluationDomain' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker IAM Permissions Check</td>
-            <td class="finding-details">No issues found with IAM permissions and no stale access detected</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker Full Access Policy Used</td>
-            <td class="finding-details">Role 'aiml-sec-test-resources-SageMakerFullAccessRole-ZREdSNCErx2S' has AmazonSageMakerFullAccess policy attached</td>
-            <td class="resolution-text">Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Direct Internet Access Enabled</td>
-            <td class="finding-details">SageMaker notebook instance 'aiml-sec-test-notebook-with-internet' has direct internet access enabled</td>
-            <td class="resolution-text">Configure the notebook instance to use VPC connectivity and disable direct internet access</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-ilmtsfeenavc' (aiml-sec-test-domain-fail-028e1010-52cbf970) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">Non-VPC Only Network Access</td>
-            <td class="finding-details">SageMaker domain 'd-cmz7ohkxxop3' (aiml-sec-test-domain-fail-fef4e7f0-bb429d11) is not configured for VPC-only access</td>
-            <td class="resolution-text">Configure the SageMaker domain to use VPC-only network access type</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-7zl8skw96ppk' (aiml-sec-test-domain-pass-028e1010-3dba8b08) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-ilmtsfeenavc' (aiml-sec-test-domain-fail-028e1010-52cbf970) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-uqjoi05f0zzp' (aiml-sec-test-domain-pass-fef4e7f0-51d1e898) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SSO Not Properly Configured</td>
-            <td class="finding-details">SageMaker domain 'd-cmz7ohkxxop3' (aiml-sec-test-domain-fail-fef4e7f0-bb429d11) is using authentication mode: IAM</td>
-            <td class="resolution-text">Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Notebook Instance 'aiml-sec-test-notebook-with-internet' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'aiml-sec-test-domain-fail-028e1010-52cbf970' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Domain 'aiml-sec-test-domain-fail-fef4e7f0-bb429d11' - No KMS key configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing Encryption Configuration</td>
-            <td class="finding-details">Training Job 'aiml-sec-test-training-no-encryption-028e1010-e2fb8765' - No output encryption configured</td>
-            <td class="resolution-text">Configure encryption using AWS KMS customer managed keys for enhanced security</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Missing VPC Encryption</td>
-            <td class="finding-details">Training Job 'aiml-sec-test-training-no-encryption-028e1010-e2fb8765' - Inter-container traffic encryption not enabled</td>
-            <td class="resolution-text">Enable encryption for inter-container traffic and VPC communication</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-in-transit.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">Model group 'aiml-sec-test-model-package-group' has minimal versioning</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Empty Model Group</td>
-            <td class="finding-details">Model group aiml-sec-test-model-package-group has no registered models</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Enabled</td>
-            <td class="finding-details">Notebook instance 'aiml-sec-test-notebook-with-internet' has root access enabled. Root access allows users to install arbitrary software, modify system configurations, and potentially escalate privileges.</td>
-            <td class="resolution-text">Disable root access by updating the notebook instance with RootAccess=Disabled. Note: Lifecycle configurations will still run with root access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook Not in VPC</td>
-            <td class="finding-details">Notebook instance 'aiml-sec-test-notebook-with-internet' is not deployed in a custom VPC. This uses SageMaker's service VPC with reduced network isolation.</td>
-            <td class="resolution-text">Create the notebook instance within a custom VPC by specifying SubnetId and SecurityGroupIds. This provides network isolation and allows use of VPC endpoints.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Disabled</td>
-            <td class="finding-details">Model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' does not have network isolation enabled. Model containers can make outbound network calls, potentially exfiltrating data.</td>
-            <td class="resolution-text">Enable network isolation by setting EnableNetworkIsolation=True when creating models. This prevents containers from making outbound network calls.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Platform Repository Access</td>
-            <td class="finding-details">Model 'SageMakerModelWithIsolation-JASFpUHjajdk' uses Platform repository access mode. Container images are pulled from public/external registries, exposing supply chain risks.</td>
-            <td class="resolution-text">Configure RepositoryAccessMode=Vpc in ImageConfig to pull images from private ECR repositories through VPC. This provides supply chain security.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Platform Repository Access</td>
-            <td class="finding-details">Model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' uses Platform repository access mode. Container images are pulled from public/external registries, exposing supply chain risks.</td>
-            <td class="resolution-text">Configure RepositoryAccessMode=Vpc in ImageConfig to pull images from private ECR repositories through VPC. This provides supply chain security.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Offline Encryption Missing</td>
-            <td class="finding-details">Feature group 'aiml-sec-test-feature-group' offline store does not have KMS encryption configured. Feature data in S3 may not be encrypted with customer-managed keys.</td>
-            <td class="resolution-text">Configure KmsKeyId in OfflineStoreConfig.S3StorageConfig when creating feature groups to encrypt offline store data with customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">All 1 processing jobs have volume encryption configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">All 1 transform jobs have volume encryption configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">Checked 1 model package groups. Approval workflows appear to be properly configured.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="agentcore" class="section">
-                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span>Amazon Bedrock AgentCore Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="agentcoreSearchInput"></div>
-                    <div class="filter-group"><label>Account</label><select id="agentcoreAccountFilter"><option value="">All Accounts</option><option value="111122223333">111122223333</option><option value="444455556666">444455556666</option><option value="777788889999">777788889999</option></select></div>
-                    <div class="filter-group"><label for="agentcoreRegionFilter">Region</label><select id="agentcoreRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
-                    <div class="filter-group"><label>Severity</label><select id="agentcoreSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="agentcoreStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="agentcoreResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="agentcoreTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">Found 1 Gateway resources</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Missing</td>
-            <td class="finding-details">The following AgentCore resources do not have resource-based policies: Gateway 'aws-news-mcp'. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to:
-1. Implement defense-in-depth access control
-2. Enable cross-account access control
-3. Restrict access based on source VPC or IP
-4. Implement hierarchical authorization for Agent Runtimes</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Missing</td>
-            <td class="finding-details">The following Gateways do not use customer-managed KMS encryption: 'aws-news-mcp'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">1. Create gateways with customer-managed KMS keys for additional control
-2. AWS-managed keys are single-tenant and region-specific
-3. Consider CMK for enhanced audit capabilities and key rotation control</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Full Access Policy</td>
-            <td class="finding-details">The following roles have BedrockAgentCoreFullAccess policy: AmazonSageMaker-ExecutionRole-20250525T153161</td>
-            <td class="resolution-text">Replace with least-privilege policies scoped to specific AgentCore resources and actions</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Wildcard Permissions</td>
-            <td class="finding-details">The following roles have wildcard AgentCore permissions on all resources: agentcore-wildrydes_gateway_role_ab3991f6-role</td>
-            <td class="resolution-text">Scope permissions to specific AgentCore resources using resource ARNs</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Stale Access</td>
-            <td class="finding-details">The following principals have not accessed AgentCore in 60+ days: role 'AmazonSageMaker-ExecutionRole-20250525T153161' (199 days), role 'AWSServiceRoleForBedrockAgentCoreRuntimeIdentity' (199 days), role 'CustomerSupportAssistantBedrockAgentCoreRole-us-east-1' (199 days), role 'resco-aiml-security-19304-AgentCoreSecurityAssessme-w773pPsFWNsn' (82 days)</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'agentcore-wildrydes_gateway_role_ab3991f6-role', role 'AIMLSecurityMemberRole', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b', role 'aws-api-mcp-server-execution-role', role 'CloudSeerTrustedServiceRole', role 'CustomerSupportStackInfra-RuntimeAgentCoreRole-N188nLB5RtLO', role 'IDP-AnalyticsProcessorFunctionRole-H3gwkJtNqrqW'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore Runtime VPC Configuration</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure VPC with private subnets and required VPC endpoints (ECR, S3, CloudWatch Logs)</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime CloudWatch Logs</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs for monitoring and troubleshooting</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Runtime X-Ray Tracing</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable X-Ray tracing for distributed tracing and performance analysis</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore ECR Repository AWS-Managed Keys</td>
-            <td class="finding-details">ECR repository 'bedrock-agentcore-customer_support_agent' uses AWS-managed keys instead of customer-managed KMS keys</td>
-            <td class="resolution-text">Consider using customer-managed KMS keys for better control and audit capabilities</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore ECR Repository AWS-Managed Keys</td>
-            <td class="finding-details">ECR repository 'bedrock-agentcore-origami_expeditions' uses AWS-managed keys instead of customer-managed KMS keys</td>
-            <td class="resolution-text">Consider using customer-managed KMS keys for better control and audit capabilities</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Runtime Storage Configuration</td>
-            <td class="finding-details">Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have storage configuration for browser tools</td>
-            <td class="resolution-text">Configure S3 storage for browser tool session recordings and artifacts</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Encryption</td>
-            <td class="finding-details">Memory 'CustomerSupportMemory-x69jBq5GLp' (CustomerSupportMemory-x69jBq5GLp) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Enable encryption with customer-managed KMS keys</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Encryption</td>
-            <td class="finding-details">Memory 'cdk_agent_core_mem-uxfIagADuF' (cdk_agent_core_mem-uxfIagADuF) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Enable encryption with customer-managed KMS keys</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Encryption</td>
-            <td class="finding-details">Memory 'wildrydes_memory_ab3991f6-9FjiHOHjT2' (wildrydes_memory_ab3991f6-9FjiHOHjT2) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Enable encryption with customer-managed KMS keys</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">Found 2 Gateway resources</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Missing</td>
-            <td class="finding-details">No AgentCore VPC endpoints found in 4 VPCs. AgentCore API traffic traverses public internet, exposing it to interception.</td>
-            <td class="resolution-text">Create VPC interface endpoints for AgentCore services:
-1. com.amazonaws.region.bedrock-agentcore
-2. com.amazonaws.region.bedrock-agentcore-control
-3. com.amazonaws.region.bedrock-agentcore-runtime
-This enables private connectivity via AWS PrivateLink</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Missing</td>
-            <td class="finding-details">The following AgentCore resources do not have resource-based policies: Runtime 'origami_expeditions', Runtime 'neoCyan_Agent', Runtime 'customer_support_agent', Runtime 'cdk_agent_core', Runtime 'awsapimcpserver' and 2 more. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to:
-1. Implement defense-in-depth access control
-2. Enable cross-account access control
-3. Restrict access based on source VPC or IP
-4. Implement hierarchical authorization for Agent Runtimes</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Missing</td>
-            <td class="finding-details">The following Gateways do not use customer-managed KMS encryption: 'customersupport-gw', 'wildrydes-gateway-ab3991f6'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">1. Create gateways with customer-managed KMS keys for additional control
-2. AWS-managed keys are single-tenant and region-specific
-3. Consider CMK for enhanced audit capabilities and key rotation control</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Full Access Check</td>
-            <td class="finding-details">No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Stale Access</td>
-            <td class="finding-details">The following principals have not accessed AgentCore in 60+ days: role 'resco-aiml-security-23026-AgentCoreSecurityAssessme-2AEt2MTxg4AU' (82 days)</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
-            <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
-            <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Wildcard Permissions</td>
-            <td class="finding-details">The following roles have wildcard AgentCore permissions on all resources: aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV</td>
-            <td class="resolution-text">Scope permissions to specific AgentCore resources using resource ARNs</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV', role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore ECR Repository AWS-Managed Keys</td>
-            <td class="finding-details">ECR repository 'aiml-sec-test-agentcore-no-encryption' uses AWS-managed keys instead of customer-managed KMS keys</td>
-            <td class="resolution-text">Consider using customer-managed KMS keys for better control and audit capabilities</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AmazonBedrockFullAccess role check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No roles found with AmazonBedrockFullAccess policy</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
+https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No identities found with overly permissive marketplace subscription access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="agentic" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span>Agentic AI Security Findings</div><div class="muted" style="margin:-6px 0 10px;font-size:13px;">Scope: API-provable Agentic AI security controls mapped to the AWS Well-Architected Agentic AI Lens security guidance. Human-in-the-loop governance is referenced in methodology but not scored automatically unless an AWS API can prove the control.</div><div class="filter-bar"><div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="agenticSearchInput"></div><div class="filter-group"><label>Account</label><select id="agenticAccountFilter"><option value="">All Accounts</option><option value="111122223333">111122223333</option><option value="444455556666">444455556666</option><option value="777788889999">777788889999</option></select></div><div class="filter-group"><label>Region</label><select id="agenticRegionFilter"><option value="">All Regions</option><option value="Global">Global</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option></select></div><div class="filter-group"><label>Severity</label><select id="agenticSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div><div class="filter-group"><label>Status</label><select id="agenticStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div><button class="btn btn-reset" id="agenticResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button></div><div class="card"><div class="table-wrap"><table id="agenticTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
+1. Create and version your prompts
+2. Test different prompt variants
+3. Share prompts across your organization
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Cross-Account Guardrails Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Check must run in AWS Organizations management account to evaluate organizational policies</p></div>
+                        <div><strong>Resolution</strong><p>Run assessment in management account to check cross-account guardrails enforcement</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) uses authorizerType CUSTOM_JWT.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</td>
-            <td class="resolution-text">Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) does not expose DEBUG-level exception detail.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection Missing</td>
-            <td class="finding-details">Gateway 'aws-news-mcp' (aws-news-mcp-vx9kxwqv9p) is not associated with an AWS WAF web ACL.</td>
-            <td class="resolution-text">Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: The following AgentCore resources do not have resource-based policies: Gateway 'aws-news-mcp'. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: The following Gateways do not use customer-managed KMS encryption: 'aws-news-mcp'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is properly configured with delivery to: Amazon S3, CloudWatch Logs</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>BR-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>BR-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 11 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: 1 guardrails have complete content filter coverage (hate, insults, sexual, violence)</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: Guardrail 'nist-ai-rmf-guardrail' (ID: do7xkmhadx7k) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: 1 guardrails have sensitive-information (PII) filters configured</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: 1 guardrails have contextual grounding checks enabled</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>AG-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Guardrail Enforcement Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</p></div>
+                        <div><strong>Resolution</strong><p>Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 7 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) is missing content filters: HATE, VIOLENCE, SEXUAL, INSULTS. Complete content filter coverage is essential for comprehensive content safety.</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have an Automated Reasoning policy configured. Automated Reasoning provides formal verification of model responses against defined policies.</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) has no sensitive-information filters configured (no PII entities or regex patterns). Prompts and model responses are not screened for sensitive data such as PII.</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: Guardrail 'Sample-Guardrail' (ID: mmi5rrre65gv) does not have contextual grounding checks enabled. Without grounding and relevance checks, the guardrail cannot detect hallucinated (ungrounded) or off-topic model responses.</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore IAM Full Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No roles with overly permissive AgentCore access found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Stale Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following principals have not accessed AgentCore in 60+ days: role 'resco-aiml-security-23026-AgentCoreSecurityAssessme-2AEt2MTxg4AU' (82 days)</p></div>
+                        <div><strong>Resolution</strong><p>Review and remove unused AgentCore permissions following least privilege principle</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Unused Permissions</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</p></div>
+                        <div><strong>Resolution</strong><p>Review and remove unused AgentCore permissions following least privilege principle</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Service-Linked Role Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</p></div>
+                        <div><strong>Resolution</strong><p>The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) uses authorizerType CUSTOM_JWT.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</td>
-            <td class="resolution-text">Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) does not expose DEBUG-level exception detail.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection Missing</td>
-            <td class="finding-details">Gateway 'customersupport-gw' (customersupport-gw-oxqopzjxae) is not associated with an AWS WAF web ACL.</td>
-            <td class="resolution-text">Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) uses authorizerType CUSTOM_JWT.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement Missing</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) does not have a policy engine configuration. Tool calls are not evaluated by AgentCore policy enforcement.</td>
-            <td class="resolution-text">Attach an AgentCore policy engine to the gateway and use ENFORCE mode for production tool authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) does not expose DEBUG-level exception detail.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection Missing</td>
-            <td class="finding-details">Gateway 'wildrydes-gateway-ab3991f6' (wildrydes-gateway-ab3991f6-jrlh9ok6ya) is not associated with an AWS WAF web ACL.</td>
-            <td class="resolution-text">Associate an AWS WAF web ACL with internet-facing AgentCore gateways to add request filtering and abuse protection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have BedrockAgentCoreFullAccess policy: AmazonSageMaker-ExecutionRole-20250525T153161</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
             <td><code>Global</code></td>
             <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have wildcard AgentCore permissions on all resources: agentcore-wildrydes_gateway_role_ab3991f6-role</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: No roles with overly permissive AgentCore access found</p></div>
+                        <div><strong>Resolution</strong><p>Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
             <td><code>Global</code></td>
             <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have not accessed AgentCore in 60+ days: role 'AmazonSageMaker-ExecutionRole-20250525T153161' (199 days), role 'AWSServiceRoleForBedrockAgentCoreRuntimeIdentity' (199 days), role 'CustomerSupportAssistantBedrockAgentCoreRole-us-east-1' (199 days), role 'resco-aiml-security-19304-AgentCoreSecurityAssessme-w773pPsFWNsn' (82 days)</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Stale AgentCore Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have not accessed AgentCore in 60+ days: role 'resco-aiml-security-23026-AgentCoreSecurityAssessme-2AEt2MTxg4AU' (82 days)</p></div>
+                        <div><strong>Resolution</strong><p>Remove or restrict stale AgentCore permissions for principals that no longer need access.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="Global">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
             <td><code>Global</code></td>
             <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'agentcore-wildrydes_gateway_role_ab3991f6-role', role 'AIMLSecurityMemberRole', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-a6ddf3fc76', role 'AmazonBedrockAgentCoreSDKRuntime-us-east-1-ed660add8b', role 'aws-api-mcp-server-execution-role', role 'CloudSeerTrustedServiceRole', role 'CustomerSupportStackInfra-RuntimeAgentCoreRole-N188nLB5RtLO', role 'IDP-AnalyticsProcessorFunctionRole-H3gwkJtNqrqW'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Stale AgentCore Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</p></div>
+                        <div><strong>Resolution</strong><p>Remove or restrict stale AgentCore permissions for principals that no longer need access.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) is not configured with VPC. This exposes the runtime to public internet.</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'origami_expeditions' (origami_expeditions-TR4jDoHXe8) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'neoCyan_Agent' (neoCyan_Agent-yAFXSWFaA3) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'customer_support_agent' (customer_support_agent-ZP4e8z55dP) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'cdk_agent_core' (cdk_agent_core-7FqFlD86LW) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have CloudWatch Logs configured</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: Runtime 'awsapimcpserver' (awsapimcpserver-mJrqgt37GO) does not have X-Ray tracing enabled</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'CustomerSupportMemory-x69jBq5GLp' (CustomerSupportMemory-x69jBq5GLp) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'cdk_agent_core_mem-uxfIagADuF' (cdk_agent_core_mem-uxfIagADuF) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: Memory 'wildrydes_memory_ab3991f6-9FjiHOHjT2' (wildrydes_memory_ab3991f6-9FjiHOHjT2) does not have customer-managed encryption configured</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore VPC endpoints found in 4 VPCs. AgentCore API traffic traverses public internet, exposing it to interception.</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: The following AgentCore resources do not have resource-based policies: Runtime 'origami_expeditions', Runtime 'neoCyan_Agent', Runtime 'customer_support_agent', Runtime 'cdk_agent_core', Runtime 'awsapimcpserver' and 2 more. Without RBPs, access control relies solely on identity-based policies.</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: The following Gateways do not use customer-managed KMS encryption: 'customersupport-gw', 'wildrydes-gateway-ab3991f6'. Gateway configuration data uses AWS-managed keys.</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
+            <td><code>444455556666</code></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker IAM Permissions Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No issues found with IAM permissions and no stale access detected</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+            <td><code>444455556666</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-00</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in us-east-1; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+            <td><code>444455556666</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>FS-00</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-00</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+            <td><code>444455556666</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
+1. Create and version your prompts
+2. Test different prompt variants
+3. Share prompts across your organization
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</p></div>
+                        <div><strong>Resolution</strong><p>Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
             <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
 <tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
             <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore IAM Wildcard Permissions</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following roles have wildcard AgentCore permissions on all resources: aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV</p></div>
+                        <div><strong>Resolution</strong><p>Scope permissions to specific AgentCore resources using resource ARNs</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Unused Permissions</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following principals have AgentCore permissions but have never accessed the service: role 'aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV', role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</p></div>
+                        <div><strong>Resolution</strong><p>Review and remove unused AgentCore permissions following least privilege principle</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Service-Linked Role Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</p></div>
+                        <div><strong>Resolution</strong><p>The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore ECR Repository AWS-Managed Keys</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>ECR repository 'aiml-sec-test-agentcore-no-encryption' uses AWS-managed keys instead of customer-managed KMS keys</p></div>
+                        <div><strong>Resolution</strong><p>Consider using customer-managed KMS keys for better control and audit capabilities</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
             <td><code>Global</code></td>
             <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have wildcard AgentCore permissions on all resources: aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV</p></div>
+                        <div><strong>Resolution</strong><p>Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have not accessed AgentCore in 60+ days: role 'resco-aiml-security-23026-AgentCoreSecurityAssessme-2AEt2MTxg4AU' (82 days)</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="Global">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
             <td><code>Global</code></td>
             <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Stale AgentCore Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV', role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</p></div>
+                        <div><strong>Resolution</strong><p>Remove or restrict stale AgentCore permissions for principals that no longer need access.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AG-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
+1. Create and version your prompts
+2. Test different prompt variants
+3. Share prompts across your organization
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</p></div>
+                        <div><strong>Resolution</strong><p>Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34312,10 +16364,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34323,10 +16382,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34334,10 +16400,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34345,10 +16418,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34356,10 +16436,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34367,10 +16454,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34378,10 +16472,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34389,10 +16490,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -34400,3690 +16508,4661 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>777788889999</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AG-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Full Access Policy Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'aiml-sec-test-resources-SageMakerFullAccessRole-ZREdSNCErx2S' has AmazonSageMakerFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Replace AmazonSageMakerFullAccess with more restrictive custom policies that follow the principle of least privilege</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Direct Internet Access Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker notebook instance 'aiml-sec-test-notebook-with-internet' has direct internet access enabled</p></div>
+                        <div><strong>Resolution</strong><p>Configure the notebook instance to use VPC connectivity and disable direct internet access</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Non-VPC Only Network Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-ilmtsfeenavc' (aiml-sec-test-domain-fail-028e1010-52cbf970) is not configured for VPC-only access</p></div>
+                        <div><strong>Resolution</strong><p>Configure the SageMaker domain to use VPC-only network access type</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Non-VPC Only Network Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-cmz7ohkxxop3' (aiml-sec-test-domain-fail-fef4e7f0-bb429d11) is not configured for VPC-only access</p></div>
+                        <div><strong>Resolution</strong><p>Configure the SageMaker domain to use VPC-only network access type</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SSO Not Properly Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-7zl8skw96ppk' (aiml-sec-test-domain-pass-028e1010-3dba8b08) is using authentication mode: IAM</p></div>
+                        <div><strong>Resolution</strong><p>Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SSO Not Properly Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-ilmtsfeenavc' (aiml-sec-test-domain-fail-028e1010-52cbf970) is using authentication mode: IAM</p></div>
+                        <div><strong>Resolution</strong><p>Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SSO Not Properly Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-uqjoi05f0zzp' (aiml-sec-test-domain-pass-fef4e7f0-51d1e898) is using authentication mode: IAM</p></div>
+                        <div><strong>Resolution</strong><p>Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SSO Not Properly Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>SageMaker domain 'd-cmz7ohkxxop3' (aiml-sec-test-domain-fail-fef4e7f0-bb429d11) is using authentication mode: IAM</p></div>
+                        <div><strong>Resolution</strong><p>Enable and properly configure AWS IAM Identity Center (successor to AWS SSO) for centralized access management. Ensure Identity Store ID is configured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Missing Encryption Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Notebook Instance 'aiml-sec-test-notebook-with-internet' - No KMS key configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure encryption using AWS KMS customer managed keys for enhanced security</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Missing Encryption Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Domain 'aiml-sec-test-domain-fail-028e1010-52cbf970' - No KMS key configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure encryption using AWS KMS customer managed keys for enhanced security</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Missing Encryption Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Domain 'aiml-sec-test-domain-fail-fef4e7f0-bb429d11' - No KMS key configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure encryption using AWS KMS customer managed keys for enhanced security</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Missing Encryption Configuration</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Training Job 'aiml-sec-test-training-no-encryption-028e1010-e2fb8765' - No output encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>Configure encryption using AWS KMS customer managed keys for enhanced security</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Missing VPC Encryption</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Training Job 'aiml-sec-test-training-no-encryption-028e1010-e2fb8765' - Inter-container traffic encryption not enabled</p></div>
+                        <div><strong>Resolution</strong><p>Enable encryption for inter-container traffic and VPC communication</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-in-transit.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model group 'aiml-sec-test-model-package-group' has minimal versioning</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Empty Model Group</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model group aiml-sec-test-model-package-group has no registered models</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Notebook instance 'aiml-sec-test-notebook-with-internet' has root access enabled. Root access allows users to install arbitrary software, modify system configurations, and potentially escalate privileges.</p></div>
+                        <div><strong>Resolution</strong><p>Disable root access by updating the notebook instance with RootAccess=Disabled. Note: Lifecycle configurations will still run with root access.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Not in VPC</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Notebook instance 'aiml-sec-test-notebook-with-internet' is not deployed in a custom VPC. This uses SageMaker's service VPC with reduced network isolation.</p></div>
+                        <div><strong>Resolution</strong><p>Create the notebook instance within a custom VPC by specifying SubnetId and SecurityGroupIds. This provides network isolation and allows use of VPC endpoints.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Disabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' does not have network isolation enabled. Model containers can make outbound network calls, potentially exfiltrating data.</p></div>
+                        <div><strong>Resolution</strong><p>Enable network isolation by setting EnableNetworkIsolation=True when creating models. This prevents containers from making outbound network calls.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Platform Repository Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model 'SageMakerModelWithIsolation-JASFpUHjajdk' uses Platform repository access mode. Container images are pulled from public/external registries, exposing supply chain risks.</p></div>
+                        <div><strong>Resolution</strong><p>Configure RepositoryAccessMode=Vpc in ImageConfig to pull images from private ECR repositories through VPC. This provides supply chain security.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Platform Repository Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' uses Platform repository access mode. Container images are pulled from public/external registries, exposing supply chain risks.</p></div>
+                        <div><strong>Resolution</strong><p>Configure RepositoryAccessMode=Vpc in ImageConfig to pull images from private ECR repositories through VPC. This provides supply chain security.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Offline Encryption Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Feature group 'aiml-sec-test-feature-group' offline store does not have KMS encryption configured. Feature data in S3 may not be encrypted with customer-managed keys.</p></div>
+                        <div><strong>Resolution</strong><p>Configure KmsKeyId in OfflineStoreConfig.S3StorageConfig when creating feature groups to encrypt offline store data with customer-managed KMS keys.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All 1 processing jobs have volume encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All 1 transform jobs have volume encryption configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Checked 1 model package groups. Approval workflows appear to be properly configured.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
-            <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: The following roles have wildcard AgentCore permissions on all resources: aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'aiml-sec-test-resources-AgentCoreOverlyPermissiveRo-IQso7VQN0jOV', role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 9 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: 1 agents have an associated guardrail</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="777788889999" data-region="eu-west-1">
             <td><code>777788889999</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div></section>
-            <section id="finserv" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span>Financial Services GenAI Risk Findings</div><div class="muted" style="margin:-6px 0 10px;font-size:13px;">Scope: this assessment records findings against each resolved CloudFormation TargetRegions entry. These checks are based on <a href="https://aws.amazon.com/blogs/security/introducing-the-updated-aws-user-guide-to-governance-risk-and-compliance-for-responsible-ai-adoption/" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>. Severities follow a documented Likelihood &times; Impact methodology (see docs).</div><div class="filter-bar"><div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="finservSearchInput"></div><div class="filter-group"><label>Account</label><select id="finservAccountFilter"><option value="">All Accounts</option><option value="111122223333">111122223333</option><option value="444455556666">444455556666</option><option value="777788889999">777788889999</option></select></div><div class="filter-group"><label>Region</label><select id="finservRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option></select></div><div class="filter-group"><label>Severity</label><select id="finservSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div><div class="filter-group"><label>Status</label><select id="finservStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div><button class="btn btn-reset" id="finservResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button></div><div class="card"><div class="table-wrap"><table id="finservTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="finserv" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">AWS Shield Advanced Not Enabled</td>
-            <td class="finding-details">AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Subscribe to AWS Shield Advanced for DDoS protection.
-2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
-3. Enable Shield Response Team (SRT) access and configure proactive engagement.
-4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-01</code></td>
-            <td class="col-domain">AWS Shield Advanced Not Enabled</td>
-            <td class="finding-details">AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Subscribe to AWS Shield Advanced for DDoS protection.
+            <td class="finding-summary">
+                <div class="col-domain">AWS Shield Advanced Not Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</p></div>
+                        <div><strong>Resolution</strong><p>1. Subscribe to AWS Shield Advanced for DDoS protection.
 2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
 3. Enable Shield Response Team (SRT) access and configure proactive engagement.
-4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-01</code></td>
-            <td class="col-domain">No Regional WAF Web ACLs Found</td>
-            <td class="finding-details">No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</td>
-            <td class="resolution-text">1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
-2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
-3. Add AWS Managed Rules for known bad inputs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">No Regional WAF Web ACLs Found</td>
-            <td class="finding-details">No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</td>
-            <td class="resolution-text">1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
+            <td class="finding-summary">
+                <div class="col-domain">No Regional WAF Web ACLs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
 2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
-3. Add AWS Managed Rules for known bad inputs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Add AWS Managed Rules for known bad inputs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-02</code></td>
-            <td class="col-domain">API Gateway Usage Plans Missing Throttle</td>
-            <td class="finding-details">Usage plans without throttling: myAskMeAnything-UsagePlan. Unbounded API calls can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">Set rateLimit and burstLimit on all usage plans associated with GenAI API stages. Consider per-consumer API keys with individual quotas.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-02</code></td>
-            <td class="col-domain">API Gateway Usage Plans Missing Throttle</td>
-            <td class="finding-details">Usage plans without throttling: myAskMeAnything-UsagePlan. Unbounded API calls can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">Set rateLimit and burstLimit on all usage plans associated with GenAI API stages. Consider per-consumer API keys with individual quotas.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">No API Gateway Usage Plans Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No usage plans configured. GenAI API endpoints may have no rate limits.</p></div>
+                        <div><strong>Resolution</strong><p>Create API Gateway usage plans with throttle settings (rateLimit and burstLimit) for all Bedrock-facing APIs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-03</code></td>
-            <td class="col-domain">Bedrock Token Quotas Customized</td>
-            <td class="finding-details">Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</td>
-            <td class="resolution-text">No action required. Periodically re-review quotas against expected peak load.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-03</code></td>
-            <td class="col-domain">Bedrock Token Quotas Customized</td>
-            <td class="finding-details">Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</td>
-            <td class="resolution-text">No action required. Periodically re-review quotas against expected peak load.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Token Quotas Customized</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Periodically re-review quotas against expected peak load.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-04</code></td>
-            <td class="col-domain">No Cost Anomaly Detection Monitors</td>
-            <td class="finding-details">No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</td>
-            <td class="resolution-text">1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
-2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
-3. Set daily spend budgets with AWS Budgets as a secondary control.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-04</code></td>
-            <td class="col-domain">No Cost Anomaly Detection Monitors</td>
-            <td class="finding-details">No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</td>
-            <td class="resolution-text">1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
+            <td class="finding-summary">
+                <div class="col-domain">No Cost Anomaly Detection Monitors</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
 2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
-3. Set daily spend budgets with AWS Budgets as a secondary control.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Set daily spend budgets with AWS Budgets as a secondary control.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-05</code></td>
-            <td class="col-domain">No Bedrock CloudWatch Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms for:
-- AWS/Bedrock InvocationThrottles (threshold > 0)
-- AWS/Bedrock TokensProcessed (threshold based on quota)
-- Custom application-level token counters via EMF</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-05</code></td>
-            <td class="col-domain">No Bedrock CloudWatch Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms for:
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock CloudWatch Alarms Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms for:
 - AWS/Bedrock InvocationThrottles (threshold > 0)
 - AWS/Bedrock TokensProcessed (threshold based on quota)
-- Custom application-level token counters via EMF</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+- Custom application-level token counters via EMF</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-06</code></td>
-            <td class="col-domain">No AI/ML Service Budgets Configured</td>
-            <td class="finding-details">No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</td>
-            <td class="resolution-text">1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
-2. Add SNS notifications to on-call channels.
-3. Consider budget actions to apply IAM deny policies when thresholds are breached.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-06</code></td>
-            <td class="col-domain">No AI/ML Service Budgets Configured</td>
-            <td class="finding-details">No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</td>
-            <td class="resolution-text">1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
+            <td class="finding-summary">
+                <div class="col-domain">No AI/ML Service Budgets Configured</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
 2. Add SNS notifications to on-call channels.
-3. Consider budget actions to apply IAM deny policies when thresholds are breached.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Consider budget actions to apply IAM deny policies when thresholds are breached.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-07</code></td>
-            <td class="col-domain">Agent Action Boundary Check</td>
-            <td class="finding-details">No Bedrock agents found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-07</code></td>
-            <td class="col-domain">Agent Action Boundary Check</td>
-            <td class="finding-details">No Bedrock agents found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-08</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing Policy Engine</td>
-            <td class="finding-details">Runtimes without authorizer configuration: origami_expeditions, neoCyan_Agent, customer_support_agent, cdk_agent_core, awsapimcpserver. Without a policy engine, agents can invoke any registered tool without authorization checks.</td>
-            <td class="resolution-text">Configure an authorizer (Lambda or Cedar policy store) on each AgentCore runtime to enforce fine-grained tool-call authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Boundaries Look Appropriate</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Reviewed 1 agent(s); no wildcard sensitive actions found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-08</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing Policy Engine</td>
-            <td class="finding-details">Runtimes without authorizer configuration: origami_expeditions, neoCyan_Agent, customer_support_agent, cdk_agent_core, awsapimcpserver. Without a policy engine, agents can invoke any registered tool without authorization checks.</td>
-            <td class="resolution-text">Configure an authorizer (Lambda or Cedar policy store) on each AgentCore runtime to enforce fine-grained tool-call authorization.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">No AgentCore Runtimes Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore runtimes found; policy engine check not applicable.</p></div>
+                        <div><strong>Resolution</strong><p>If using AgentCore, configure the Policy Engine to authorize tool calls.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-09</code></td>
-            <td class="col-domain">Agent Lambda Functions Without Concurrency Limits</td>
-            <td class="finding-details">Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-111122223333-FinServAssessment, resco-aiml-IAMPermissionCaching, aiml-security-aiml-security-111122223333-SagemakerAssessment, resco-aiml-CleanupBucket, aiml-security-aiml-security-111122223333-BedrockAssessment, resco-aiml-BedrockAssessment, aiml-security-aiml-security-111122223333-CleanupBucket, aiml-security-aiml-security-111122223333-AgentCoreAssessment, e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Unlimited concurrency allows runaway agent loops to exhaust account limits.</td>
-            <td class="resolution-text">1. Set reserved concurrency on agent Lambda functions.
-2. Implement maximum iteration counts in agent orchestration logic.
-3. Use Step Functions with MaxConcurrency and timeout states.
-4. Add circuit-breaker patterns to agent tool invocations.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-09</code></td>
-            <td class="col-domain">Agent Lambda Functions Without Concurrency Limits</td>
-            <td class="finding-details">Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-111122223333-FinServAssessment, resco-aiml-IAMPermissionCaching, aiml-security-aiml-security-111122223333-SagemakerAssessment, resco-aiml-CleanupBucket, aiml-security-aiml-security-111122223333-BedrockAssessment, resco-aiml-BedrockAssessment, aiml-security-aiml-security-111122223333-CleanupBucket, aiml-security-aiml-security-111122223333-AgentCoreAssessment, e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Unlimited concurrency allows runaway agent loops to exhaust account limits.</td>
-            <td class="resolution-text">1. Set reserved concurrency on agent Lambda functions.
+            <td class="finding-summary">
+                <div class="col-domain">Agent Lambda Functions Without Concurrency Limits</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-mgmt-FinServAssessment, aiml-sec-test-resources-SageMakerJobCustomResource-ZA5QCAi0pN3d, AIMLSecurityAssessment-CodeBuildStartBuildLambda-VYOqtzWoNo3m, aiml-security-aiml-security-mgmt-CleanupBucket, aiml-security-aiml-security-mgmt-SagemakerAssessment, aiml-security-aiml-security-mgmt-GenerateReport, aiml-security-aiml-security-mgmt-IAMPermissionCaching, aiml-security-aiml-security-mgmt-AgentCoreAssessment, aiml-security-aiml-security-mgmt-BedrockAssessment, aiml-security-aiml-security-mgmt-ResolveRegions. Unlimited concurrency allows runaway agent loops to exhaust account limits.</p></div>
+                        <div><strong>Resolution</strong><p>1. Set reserved concurrency on agent Lambda functions.
 2. Implement maximum iteration counts in agent orchestration logic.
 3. Use Step Functions with MaxConcurrency and timeout states.
-4. Add circuit-breaker patterns to agent tool invocations.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Add circuit-breaker patterns to agent tool invocations.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-10</code></td>
-            <td class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</td>
-            <td class="finding-details">No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</td>
-            <td class="resolution-text">Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-10</code></td>
-            <td class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</td>
-            <td class="finding-details">No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</td>
-            <td class="resolution-text">Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-11</code></td>
-            <td class="col-domain">No Agent Rate Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms on:
-- Bedrock agent invocation counts (threshold based on expected max)
-- Lambda invocation errors for agent functions
-- Step Functions execution failures and timeouts</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-11</code></td>
-            <td class="col-domain">No Agent Rate Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms on:
+            <td class="finding-summary">
+                <div class="col-domain">No Agent Rate Alarms Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms on:
 - Bedrock agent invocation counts (threshold based on expected max)
 - Lambda invocation errors for agent functions
-- Step Functions execution failures and timeouts</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+- Step Functions execution failures and timeouts</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-12</code></td>
-            <td class="col-domain">No Bedrock-Scoped SCPs Found</td>
-            <td class="finding-details">No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</td>
-            <td class="resolution-text">1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
-2. Use bedrock:ModelId condition key to allowlist approved models.
-3. Maintain a model inventory and update the SCP when models are approved/retired.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-12</code></td>
-            <td class="col-domain">No Bedrock-Scoped SCPs Found</td>
-            <td class="finding-details">No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</td>
-            <td class="resolution-text">1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock-Scoped SCPs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
 2. Use bedrock:ModelId condition key to allowlist approved models.
-3. Maintain a model inventory and update the SCP when models are approved/retired.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Maintain a model inventory and update the SCP when models are approved/retired.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-13</code></td>
-            <td class="col-domain">Model Provenance Tags Present</td>
-            <td class="finding-details">All reviewed models have required provenance tags.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-13</code></td>
-            <td class="col-domain">Model Provenance Tags Present</td>
-            <td class="finding-details">All reviewed models have required provenance tags.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Models Missing Provenance Tags</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>2 model(s) missing required provenance tags:
+- SageMaker model 'SageMakerModelWithIsolation-JASFpUHjajdk' missing tags: {'source', 'approval-date', 'version'}
+- SageMaker model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' missing tags: {'source', 'approval-date', 'version'}</p></div>
+                        <div><strong>Resolution</strong><p>Tag all models with: source (e.g., 'aws-marketplace', 'internal'), version, and approval-date. Enforce tagging via SCP or AWS Config rule.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-14</code></td>
-            <td class="col-domain">Model Governance Config Rules Present</td>
-            <td class="finding-details">Found 11 model-related Config rule(s).</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-14</code></td>
-            <td class="col-domain">Model Governance Config Rules Present</td>
-            <td class="finding-details">Found 11 model-related Config rule(s).</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Governance Config Rules Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 13 model-related Config rule(s).</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-15</code></td>
-            <td class="col-domain">No Bedrock Evaluation Jobs Found</td>
-            <td class="finding-details">No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</td>
-            <td class="resolution-text">1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
-2. Use FMEval library for automated robustness testing.
-3. Schedule periodic re-evaluation after model updates.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-15</code></td>
-            <td class="col-domain">No Bedrock Evaluation Jobs Found</td>
-            <td class="finding-details">No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</td>
-            <td class="resolution-text">1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
+            <td class="finding-summary">
+                <div class="col-domain">No Bedrock Evaluation Jobs Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
 2. Use FMEval library for automated robustness testing.
-3. Schedule periodic re-evaluation after model updates.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Schedule periodic re-evaluation after model updates.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-16</code></td>
-            <td class="col-domain">ECR Repositories Without Image Scanning</td>
-            <td class="finding-details">4 ECR repo(s) without scan-on-push: mlexplorationrepo, cdk-hnb659fds-container-assets-111122223333-us-east-1, bedrock-agentcore-customer_support_agent, bedrock-agentcore-origami_expeditions.</td>
-            <td class="resolution-text">Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-16</code></td>
-            <td class="col-domain">ECR Repositories Without Image Scanning</td>
-            <td class="finding-details">4 ECR repo(s) without scan-on-push: mlexplorationrepo, cdk-hnb659fds-container-assets-111122223333-us-east-1, bedrock-agentcore-customer_support_agent, bedrock-agentcore-origami_expeditions.</td>
-            <td class="resolution-text">Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">ECR Repositories Without Image Scanning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>2 ECR repo(s) without scan-on-push: cdk-hnb659fds-container-assets-777788889999-us-east-1, aiml-sec-test-agentcore-no-encryption.</p></div>
+                        <div><strong>Resolution</strong><p>Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-20</code></td>
-            <td class="col-domain">No SageMaker Feature Groups Found</td>
-            <td class="finding-details">No SageMaker Feature Store groups found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-20</code></td>
-            <td class="col-domain">No SageMaker Feature Groups Found</td>
-            <td class="finding-details">No SageMaker Feature Store groups found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-21</code></td>
-            <td class="col-domain">Training Data Buckets Without Versioning</td>
-            <td class="finding-details">13 training data bucket(s) without versioning: ancbedrocklogging, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, fsi-genai-workshop-bedrock-datasources-111122223333-us-west-2, knowledgebase-bedrock-agent-agasthik, llmevaluationpromptfoo-bedrockkb-cozhbzbrcmd2, sagemaker-studio-111122223333-huo1mvme4t.</td>
-            <td class="resolution-text">Enable S3 versioning on all training data buckets. Consider enabling MFA Delete for additional protection against poisoning.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Feature Groups Without Offline Store</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>1 feature group(s) lack an active offline store: aiml-sec-test-feature-group. Without offline store, historical feature data cannot be used for rollback.</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable offline store (S3-backed) for all production feature groups.
+2. Enable S3 versioning on the offline store bucket.
+3. Document rollback procedures for poisoned feature data.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-offline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-21</code></td>
-            <td class="col-domain">Training Data Buckets Without Versioning</td>
-            <td class="finding-details">13 training data bucket(s) without versioning: ancbedrocklogging, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, fsi-genai-workshop-bedrock-datasources-111122223333-us-west-2, knowledgebase-bedrock-agent-agasthik, llmevaluationpromptfoo-bedrockkb-cozhbzbrcmd2, sagemaker-studio-111122223333-huo1mvme4t.</td>
-            <td class="resolution-text">Enable S3 versioning on all training data buckets. Consider enabling MFA Delete for additional protection against poisoning.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Training Data Buckets Have Versioning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All 2 training bucket(s) have versioning enabled.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-22</code></td>
-            <td class="col-domain">Overly Permissive Knowledge Base IAM Roles</td>
-            <td class="finding-details">827 role(s) with wildcard KB permissions:
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateKnowledgeBase' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateDataSource' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'Admin' allows '*'
-- Role 'agentcore-wildrydes_gateway_role_ab3991f6-role' allows 'bedrock:*'
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'Agentic-AI-MCP-Strands-SDK-Works-VSCodeInstanceRole-NCTUnlnRBFO6' allows '*'
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)</td>
-            <td class="resolution-text">Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-22</code></td>
-            <td class="col-domain">Overly Permissive Knowledge Base IAM Roles</td>
-            <td class="finding-details">827 role(s) with wildcard KB permissions:
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateKnowledgeBase' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role '111122223333-us-east-1-kb-setup-function-role' allows 'bedrock:CreateDataSource' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+            <td class="finding-summary">
+                <div class="col-domain">Overly Permissive Knowledge Base IAM Roles</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>823 role(s) with wildcard KB permissions:
 - Role 'Admin' allows '*'
-- Role 'agentcore-wildrydes_gateway_role_ab3991f6-role' allows 'bedrock:*'
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'AgentCoreEvalsSDK-us-east-1-d04ba7b68b' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'Agentic-AI-MCP-Strands-SDK-Works-VSCodeInstanceRole-NCTUnlnRBFO6' allows '*'
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-19304724716-BedrockSecurityAssessment-vv6H0eGD9ESX' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)</td>
-            <td class="resolution-text">Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+- Role 'aiml-sec-test-resources-BedrockAgentRole-RScmoTZfp2sC' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-sec-test-resources-BedrockAgentRole-RScmoTZfp2sC' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' allows 'bedrock:*'
+- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)
+- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:GetModelInvocationLoggingConfiguration' on Resource '*' (no ARN scoping to specific Knowledge Bases)</p></div>
+                        <div><strong>Resolution</strong><p>Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-24</code></td>
-            <td class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</td>
-            <td class="finding-details">Found 3 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</td>
-            <td class="resolution-text">1. Add metadata fields (tenantId, dataClassification) to KB data sources.
-2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
-3. Validate filters in integration tests to prevent cross-tenant data leakage.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-24</code></td>
-            <td class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</td>
-            <td class="finding-details">Found 3 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</td>
-            <td class="resolution-text">1. Add metadata fields (tenantId, dataClassification) to KB data sources.
-2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
-3. Validate filters in integration tests to prevent cross-tenant data leakage.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-25</code></td>
-            <td class="col-domain">OpenSearch Serverless Encryption Policies Present</td>
-            <td class="finding-details">Found 5 encryption policy(ies); 5 use a customer-managed KMS key.</td>
-            <td class="resolution-text">Verify all vector store collections use customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add metadata fields (tenantId, dataClassification) to KB data sources.
+2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
+3. Validate filters in integration tests to prevent cross-tenant data leakage.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-25</code></td>
-            <td class="col-domain">OpenSearch Serverless Encryption Policies Present</td>
-            <td class="finding-details">Found 5 encryption policy(ies); 5 use a customer-managed KMS key.</td>
-            <td class="resolution-text">Verify all vector store collections use customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">OpenSearch Serverless Encryption Policies Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 encryption policy(ies); 1 use a customer-managed KMS key.</p></div>
+                        <div><strong>Resolution</strong><p>Verify all vector store collections use customer-managed KMS keys.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-26</code></td>
-            <td class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</td>
-            <td class="finding-details">Found 5 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</td>
-            <td class="resolution-text">Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-26</code></td>
-            <td class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</td>
-            <td class="finding-details">Found 5 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</td>
-            <td class="resolution-text">Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</p></div>
+                        <div><strong>Resolution</strong><p>Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-27</code></td>
-            <td class="col-domain">Contextual Grounding Enabled on Guardrails</td>
-            <td class="finding-details">Guardrails with contextual grounding: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required for contextual grounding. Also consider enabling Automated Reasoning checks for formal policy verification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">Contextual Grounding Enabled on Guardrails</td>
-            <td class="finding-details">Guardrails with contextual grounding: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required for contextual grounding. Also consider enabling Automated Reasoning checks for formal policy verification.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-27</code></td>
-            <td class="col-domain">No Automated Reasoning Policies Found</td>
-            <td class="finding-details">No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</td>
-            <td class="resolution-text">1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
-2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
-3. Set confidenceThreshold on the policy to control strictness.
-4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
-5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">No Automated Reasoning Policies Found</td>
-            <td class="finding-details">No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</td>
-            <td class="resolution-text">1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
+            <td class="finding-summary">
+                <div class="col-domain">No Automated Reasoning Policies Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</p></div>
+                        <div><strong>Resolution</strong><p>1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
 2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
 3. Set confidenceThreshold on the policy to control strictness.
 4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
-5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-28</code></td>
-            <td class="col-domain">Denied Topics Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides broader language support and improved detection for denied topics.</td>
-            <td class="resolution-text">Verify topics cover regulated financial advice categories. For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (set topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile on the guardrail). When authoring denied-topic policies, use existing compliance materials as the source: employee policies, training materials, procedure documents, and incident reports (PDF §1.2.1 Practical guidance).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-28</code></td>
-            <td class="col-domain">Denied Topics Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides broader language support and improved detection for denied topics.</td>
-            <td class="resolution-text">Verify topics cover regulated financial advice categories. For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (set topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile on the guardrail). When authoring denied-topic policies, use existing compliance materials as the source: employee policies, training materials, procedure documents, and incident reports (PDF §1.2.1 Practical guidance).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-29</code></td>
-            <td class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</td>
-            <td class="resolution-text">1. Implement post-processing to append required disclaimers to GenAI outputs.
-2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
-3. Document disclaimer requirements in the AI use case register.
-4. Test disclaimer presence in QA/UAT before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Financial Denied Topics Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-29</code></td>
-            <td class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</td>
-            <td class="resolution-text">1. Implement post-processing to append required disclaimers to GenAI outputs.
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement post-processing to append required disclaimers to GenAI outputs.
 2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
 3. Document disclaimer requirements in the AI use case register.
-4. Test disclaimer presence in QA/UAT before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Test disclaimer presence in QA/UAT before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-30</code></td>
-            <td class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with compliance-specific datasets:
-- Fair lending test cases (ECOA, Fair Housing Act)
-- UDAP/UDAAP unfair/deceptive practice scenarios
-- AML/KYC edge cases</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-30</code></td>
-            <td class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with compliance-specific datasets:
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation with compliance-specific datasets:
 - Fair lending test cases (ECOA, Fair Housing Act)
 - UDAP/UDAAP unfair/deceptive practice scenarios
-- AML/KYC edge cases</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+- AML/KYC edge cases</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-31</code></td>
-            <td class="col-domain">Knowledge Base Data Sources Past Review Threshold</td>
-            <td class="finding-details">2 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
-- KB 'knowledge-base-semiconductors' source 'knowledge-base-quick-start-qpvuv-data-source' last synced 722 days ago
-- KB '111122223333-us-east-1-kb' source '111122223333-us-east-1-kb-datasource' last synced 199 days ago
-Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</td>
-            <td class="resolution-text">1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
-2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
-3. Set CloudWatch alarms on sync job failures.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-31</code></td>
-            <td class="col-domain">Knowledge Base Data Sources Past Review Threshold</td>
-            <td class="finding-details">2 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
-- KB 'knowledge-base-semiconductors' source 'knowledge-base-quick-start-qpvuv-data-source' last synced 722 days ago
-- KB '111122223333-us-east-1-kb' source '111122223333-us-east-1-kb-datasource' last synced 199 days ago
-Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</td>
-            <td class="resolution-text">1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Data Sources Past Review Threshold</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>1 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
+- KB 'knowledge-base-prowler-findings' source 'knowledge-base-quick-start-9lb68-data-source' last synced 423 days ago
+Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</p></div>
+                        <div><strong>Resolution</strong><p>1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
 2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
-3. Set CloudWatch alarms on sync job failures.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Set CloudWatch alarms on sync job failures.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-32</code></td>
-            <td class="col-domain">ADVISORY: Source Attribution — Manual Review Required</td>
-            <td class="finding-details">Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</td>
-            <td class="resolution-text">1. Use Bedrock RetrieveAndGenerate with citations enabled.
-2. Include source document references in response post-processing.
-3. Test citation accuracy in QA before production deployment.
-4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-32</code></td>
-            <td class="col-domain">ADVISORY: Source Attribution — Manual Review Required</td>
-            <td class="finding-details">Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</td>
-            <td class="resolution-text">1. Use Bedrock RetrieveAndGenerate with citations enabled.
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Source Attribution — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use Bedrock RetrieveAndGenerate with citations enabled.
 2. Include source document references in response post-processing.
 3. Test citation accuracy in QA before production deployment.
-4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-33</code></td>
-            <td class="col-domain">KB Data Source Buckets Without Versioning</td>
-            <td class="finding-details">KB data source S3 buckets without versioning: 111122223333-us-east-1-kb-data-bucket.</td>
-            <td class="resolution-text">Enable S3 versioning on all KB data source buckets. Enable S3 Object Integrity (checksum) for tamper detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-33</code></td>
-            <td class="col-domain">KB Data Source Buckets Without Versioning</td>
-            <td class="finding-details">KB data source S3 buckets without versioning: 111122223333-us-east-1-kb-data-bucket.</td>
-            <td class="resolution-text">Enable S3 versioning on all KB data source buckets. Enable S3 Object Integrity (checksum) for tamper detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">KB Data Source Buckets Have Versioning</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All reviewed KB data source buckets have versioning enabled.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-34</code></td>
-            <td class="col-domain">Legacy Foundation Models Available in Region</td>
-            <td class="finding-details">Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</td>
-            <td class="resolution-text">1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
-2. Migrate active usage to current model versions.
-3. Document training-data cutoff dates for all models in use.
-4. Add data-currency disclaimers to outputs from models with old cutoffs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-34</code></td>
-            <td class="col-domain">Legacy Foundation Models Available in Region</td>
-            <td class="finding-details">Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</td>
-            <td class="resolution-text">1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
+            <td class="finding-summary">
+                <div class="col-domain">Legacy Foundation Models Available in Region</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</p></div>
+                        <div><strong>Resolution</strong><p>1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
 2. Migrate active usage to current model versions.
 3. Document training-data cutoff dates for all models in use.
-4. Add data-currency disclaimers to outputs from models with old cutoffs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Add data-currency disclaimers to outputs from models with old cutoffs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-35</code></td>
-            <td class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation or FMEval with harmful content datasets:
-- Toxicity detection
-- Hate speech classification
-- Violence/self-harm content</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-35</code></td>
-            <td class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation or FMEval with harmful content datasets:
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation or FMEval with harmful content datasets:
 - Toxicity detection
 - Hate speech classification
-- Violence/self-harm content</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+- Violence/self-harm content</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-36</code></td>
-            <td class="col-domain">Guardrail Content Filters on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with content filters: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides improved contextual understanding, typographical error detection, 60+ language support, and better prompt-attack classification (distinguishes jailbreaks from prompt injection).</td>
-            <td class="resolution-text">Consider upgrading to STANDARD tier content filters for FinServ workloads that handle multiple languages or require higher detection accuracy. STANDARD tier requires cross-region inference (crossRegionDetails.guardrailProfileArn on the guardrail). To upgrade: update the guardrail's contentPolicy.filtersConfig.contentFiltersTierConfig with tierName=STANDARD and configure a guardrail cross-region profile.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-36</code></td>
-            <td class="col-domain">Guardrail Content Filters on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with content filters: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only. The STANDARD tier (GA June 2025) provides improved contextual understanding, typographical error detection, 60+ language support, and better prompt-attack classification (distinguishes jailbreaks from prompt injection).</td>
-            <td class="resolution-text">Consider upgrading to STANDARD tier content filters for FinServ workloads that handle multiple languages or require higher detection accuracy. STANDARD tier requires cross-region inference (crossRegionDetails.guardrailProfileArn on the guardrail). To upgrade: update the guardrail's contentPolicy.filtersConfig.contentFiltersTierConfig with tierName=STANDARD and configure a guardrail cross-region profile.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-37</code></td>
-            <td class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</td>
-            <td class="finding-details">User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
-2. Route flagged outputs to human reviewers via SQS/SNS.
-3. Log feedback to DynamoDB/S3 for model improvement.
-4. Define SLAs for reviewing flagged content.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Guardrail Content Filters Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-37</code></td>
-            <td class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</td>
-            <td class="finding-details">User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
 2. Route flagged outputs to human reviewers via SQS/SNS.
 3. Log feedback to DynamoDB/S3 for model improvement.
-4. Define SLAs for reviewing flagged content.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Define SLAs for reviewing flagged content.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-38</code></td>
-            <td class="col-domain">No Guardrails With Word Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have word/phrase filters. Profanity and prohibited financial terms may appear in outputs.</td>
-            <td class="resolution-text">Add word filters to guardrails:
-- Enable AWS managed profanity list
-- Add custom denylist for prohibited financial terms
-- Add allowlist for required regulatory language</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-38</code></td>
-            <td class="col-domain">No Guardrails With Word Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have word/phrase filters. Profanity and prohibited financial terms may appear in outputs.</td>
-            <td class="resolution-text">Add word filters to guardrails:
-- Enable AWS managed profanity list
-- Add custom denylist for prohibited financial terms
-- Add allowlist for required regulatory language</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Guardrail Word Filters Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-39</code></td>
-            <td class="col-domain">No SageMaker Clarify Bias Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
-2. Define protected attributes (age, gender, race proxies).
-3. Set bias metric thresholds and alert on violations.
-4. Document bias testing results for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-39</code></td>
-            <td class="col-domain">No SageMaker Clarify Bias Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Clarify Bias Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
 2. Define protected attributes (age, gender, race proxies).
 3. Set bias metric thresholds and alert on violations.
-4. Document bias testing results for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Document bias testing results for regulatory examination.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-40</code></td>
-            <td class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with bias test datasets:
-- Demographic parity test cases
-- Equal opportunity scenarios
-- Counterfactual fairness tests</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-40</code></td>
-            <td class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with bias test datasets:
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</p></div>
+                        <div><strong>Resolution</strong><p>Run Bedrock Model Evaluation with bias test datasets:
 - Demographic parity test cases
 - Equal opportunity scenarios
-- Counterfactual fairness tests</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+- Counterfactual fairness tests</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-41</code></td>
-            <td class="col-domain">No SageMaker Clarify Explainability Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify explainability for credit/lending models.
-2. Generate SHAP values for feature importance.
-3. Map top features to human-readable adverse action reason codes.
-4. Store explanations for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-41</code></td>
-            <td class="col-domain">No SageMaker Clarify Explainability Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify explainability for credit/lending models.
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Clarify Explainability Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</p></div>
+                        <div><strong>Resolution</strong><p>1. Configure SageMaker Clarify explainability for credit/lending models.
 2. Generate SHAP values for feature importance.
 3. Map top features to human-readable adverse action reason codes.
-4. Store explanations for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Store explanations for regulatory examination.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-42</code></td>
-            <td class="col-domain">No SageMaker Model Cards Found</td>
-            <td class="finding-details">No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</td>
-            <td class="resolution-text">1. Create SageMaker Model Cards for all production models.
-2. Document: intended use, out-of-scope uses, training data, bias evaluations.
-3. Include regulatory compliance attestations.
-4. Review and update cards at each model version release.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-42</code></td>
-            <td class="col-domain">No SageMaker Model Cards Found</td>
-            <td class="finding-details">No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</td>
-            <td class="resolution-text">1. Create SageMaker Model Cards for all production models.
+            <td class="finding-summary">
+                <div class="col-domain">No SageMaker Model Cards Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create SageMaker Model Cards for all production models.
 2. Document: intended use, out-of-scope uses, training data, bias evaluations.
 3. Include regulatory compliance attestations.
-4. Review and update cards at each model version release.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Review and update cards at each model version release.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-43</code></td>
-            <td class="col-domain">No CloudWatch Logs Data Protection Policies</td>
-            <td class="finding-details">No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</td>
-            <td class="resolution-text">1. Create CloudWatch Logs data protection policies to mask PII.
-2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
-3. Apply policies to Bedrock invocation log groups.
-4. Test masking with synthetic PII before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-43</code></td>
-            <td class="col-domain">No CloudWatch Logs Data Protection Policies</td>
-            <td class="finding-details">No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</td>
-            <td class="resolution-text">1. Create CloudWatch Logs data protection policies to mask PII.
+            <td class="finding-summary">
+                <div class="col-domain">No CloudWatch Logs Data Protection Policies</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</p></div>
+                        <div><strong>Resolution</strong><p>1. Create CloudWatch Logs data protection policies to mask PII.
 2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
 3. Apply policies to Bedrock invocation log groups.
-4. Test masking with synthetic PII before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Test masking with synthetic PII before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-44</code></td>
-            <td class="col-domain">Amazon Macie Enabled</td>
-            <td class="finding-details">Amazon Macie is enabled and scanning S3 buckets.</td>
-            <td class="resolution-text">Verify Macie jobs cover training data and KB data source buckets.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-44</code></td>
-            <td class="col-domain">Amazon Macie Enabled</td>
-            <td class="finding-details">Amazon Macie is enabled and scanning S3 buckets.</td>
-            <td class="resolution-text">Verify Macie jobs cover training data and KB data source buckets.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Macie Not Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon Macie is not enabled. S3 buckets containing training data and KB data sources are not being scanned for PII/sensitive data.</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable Amazon Macie in all regions where AI/ML data is stored.
+2. Create Macie classification jobs for training data and KB buckets.
+3. Configure Macie findings to route to Security Hub and SNS.
+4. Remediate PII findings before using data for model training.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-45</code></td>
-            <td class="col-domain">Guardrail PII Filters Configured</td>
-            <td class="finding-details">Guardrails with PII filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-45</code></td>
-            <td class="col-domain">Guardrail PII Filters Configured</td>
-            <td class="finding-details">Guardrails with PII filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Guardrail PII Filters Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-46</code></td>
-            <td class="col-domain">AI/ML Buckets Without Data Classification Tags</td>
-            <td class="finding-details">18 AI/ML bucket(s) without data-classification tags: 111122223333-us-east-1-kb-data-bucket, ancbedrocklogging, ancknowledgebase, aws-streaming-data-solut-outputaccesslogsbucket8b-1o7m0kb4bafm4, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, create-customer-resources-kb-bucket-111122223333.</td>
-            <td class="resolution-text">Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-46</code></td>
-            <td class="col-domain">AI/ML Buckets Without Data Classification Tags</td>
-            <td class="finding-details">18 AI/ML bucket(s) without data-classification tags: 111122223333-us-east-1-kb-data-bucket, ancbedrocklogging, ancknowledgebase, aws-streaming-data-solut-outputaccesslogsbucket8b-1o7m0kb4bafm4, bedrock-agentcore-codebuild-sources-111122223333-us-east-1, bedrock-bda-us-east-1-dda43109-6557-48bb-993d-3f97126b64b4, bedrock-bda-us-east-1-logging-00719114-debd-4487-85d1-09cbc3fc8, bedrock-kb-bucket-f736570b, bedrock-video-generation-us-east-1-h5ltpm, create-customer-resources-kb-bucket-111122223333.</td>
-            <td class="resolution-text">Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">AI/ML Buckets Without Data Classification Tags</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>3 AI/ML bucket(s) without data-classification tags: aiml-sec-test-resources-bedrockloggingbucket-wtuvpinrlpmd, aiml-sec-test-resources-sagemakerbucket-6zzmxxaxco6g, aiml-security-mgmt-aimlassessmentbucket-kbitsdgexylv.</p></div>
+                        <div><strong>Resolution</strong><p>Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-47</code></td>
-            <td class="col-domain">Guardrail Grounding Thresholds Appropriate</td>
-            <td class="finding-details">All 1 guardrail(s) with a GROUNDING filter have thresholds ≥0.7.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-47</code></td>
-            <td class="col-domain">Guardrail Grounding Thresholds Appropriate</td>
-            <td class="finding-details">All 1 guardrail(s) with a GROUNDING filter have thresholds ≥0.7.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Guardrail Grounding Threshold Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-48</code></td>
-            <td class="col-domain">Active Knowledge Bases for RAG Present</td>
-            <td class="finding-details">Found 3 active Knowledge Base(s) for RAG grounding.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-48</code></td>
-            <td class="col-domain">Active Knowledge Bases for RAG Present</td>
-            <td class="finding-details">Found 3 active Knowledge Base(s) for RAG grounding.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Active Knowledge Bases for RAG Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 active Knowledge Base(s) for RAG grounding.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-49</code></td>
-            <td class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
-2. Implement post-processing to append disclaimers.
-3. Test disclaimer presence in QA before production.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-49</code></td>
-            <td class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
 2. Implement post-processing to append disclaimers.
-3. Test disclaimer presence in QA before production.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Test disclaimer presence in QA before production.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-50</code></td>
-            <td class="col-domain">Relevance Grounding Filters Present</td>
-            <td class="finding-details">Guardrails with RELEVANCE grounding filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-50</code></td>
-            <td class="col-domain">Relevance Grounding Filters Present</td>
-            <td class="finding-details">Guardrails with RELEVANCE grounding filters: nist-ai-rmf-guardrail.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Guardrail Relevance Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-51</code></td>
-            <td class="col-domain">No Guardrails With Prompt Attack Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have PROMPT_ATTACK filters. Prompt injection attacks may bypass system prompts and access controls.</td>
-            <td class="resolution-text">1. Enable PROMPT_ATTACK content filter in Bedrock Guardrails.
-2. Set input filter strength to HIGH.
-3. Use input tags (<amazon-bedrock-guardrails-guardContent_xyz>) to differentiate user inputs from developer-provided prompts — required for PROMPT_ATTACK filters to work correctly with InvokeModel/InvokeModelWithResponseStream.
-4. Consider STANDARD tier (GA June 2025) for better jailbreak vs. injection classification and broader language support.
-5. Implement application-level input sanitization as defense-in-depth.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-prompt-attack.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-51</code></td>
-            <td class="col-domain">No Guardrails With Prompt Attack Filters</td>
-            <td class="finding-details">Found 1 guardrail(s) but none have PROMPT_ATTACK filters. Prompt injection attacks may bypass system prompts and access controls.</td>
-            <td class="resolution-text">1. Enable PROMPT_ATTACK content filter in Bedrock Guardrails.
-2. Set input filter strength to HIGH.
-3. Use input tags (<amazon-bedrock-guardrails-guardContent_xyz>) to differentiate user inputs from developer-provided prompts — required for PROMPT_ATTACK filters to work correctly with InvokeModel/InvokeModelWithResponseStream.
-4. Consider STANDARD tier (GA June 2025) for better jailbreak vs. injection classification and broader language support.
-5. Implement application-level input sanitization as defense-in-depth.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-prompt-attack.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Prompt Injection Input Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-52</code></td>
-            <td class="col-domain">Bedrock Lambda Functions on Deprecated Runtimes</td>
-            <td class="finding-details">Functions on deprecated runtimes: e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Deprecated runtimes may use outdated boto3/SDK versions lacking security patches.</td>
-            <td class="resolution-text">1. Upgrade Lambda functions to a supported runtime — Python 3.12+, Node.js 22.x or 24.x, Java 21+, or .NET 8+.
-2. Update boto3 to the latest version in Lambda layers (pin the version in requirements.txt and redeploy).
-3. Enable Lambda runtime management controls for automatic minor-version updates (runtimeManagementConfig.updateRuntimeOn = 'Auto').
-4. Refer to https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html for the authoritative list of supported and deprecated runtimes.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-52</code></td>
-            <td class="col-domain">Bedrock Lambda Functions on Deprecated Runtimes</td>
-            <td class="finding-details">Functions on deprecated runtimes: e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk, e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII. Deprecated runtimes may use outdated boto3/SDK versions lacking security patches.</td>
-            <td class="resolution-text">1. Upgrade Lambda functions to a supported runtime — Python 3.12+, Node.js 22.x or 24.x, Java 21+, or .NET 8+.
-2. Update boto3 to the latest version in Lambda layers (pin the version in requirements.txt and redeploy).
-3. Enable Lambda runtime management controls for automatic minor-version updates (runtimeManagementConfig.updateRuntimeOn = 'Auto').
-4. Refer to https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html for the authoritative list of supported and deprecated runtimes.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Lambda Functions on Current Runtimes</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>All 10 Bedrock Lambda function(s) use current runtimes.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-53</code></td>
-            <td class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF Web ACLs with injection protection rules (see FS-01).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-53</code></td>
-            <td class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF Web ACLs with injection protection rules (see FS-01).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional WAF Web ACLs found.</p></div>
+                        <div><strong>Resolution</strong><p>Create WAF Web ACLs with injection protection rules (see FS-01).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-54</code></td>
-            <td class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</td>
-            <td class="finding-details">Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</td>
-            <td class="resolution-text">1. Conduct penetration testing of GenAI applications at least annually and before major releases.
-2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
-3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
-4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
-5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-54</code></td>
-            <td class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</td>
-            <td class="finding-details">Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</td>
-            <td class="resolution-text">1. Conduct penetration testing of GenAI applications at least annually and before major releases.
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</p></div>
+                        <div><strong>Resolution</strong><p>1. Conduct penetration testing of GenAI applications at least annually and before major releases.
 2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
 3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
 4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
-5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-55</code></td>
-            <td class="col-domain">No Output Validation Functions Found</td>
-            <td class="finding-details">No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</td>
-            <td class="resolution-text">1. Implement output validation Lambda functions in GenAI pipelines.
+            <td class="finding-summary">
+                <div class="col-domain">No Output Validation Functions Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</p></div>
+                        <div><strong>Resolution</strong><p>1. Implement output validation Lambda functions in GenAI pipelines.
 2. Validate output schema, length, and content before downstream use.
 3. Sanitize outputs before rendering in web UIs (XSS prevention).
-4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-55</code></td>
-            <td class="col-domain">No Output Validation Functions Found</td>
-            <td class="finding-details">No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</td>
-            <td class="resolution-text">1. Implement output validation Lambda functions in GenAI pipelines.
-2. Validate output schema, length, and content before downstream use.
-3. Sanitize outputs before rendering in web UIs (XSS prevention).
-4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</p></div>
+                        <div><strong>Reference</strong><p><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-56</code></td>
-            <td class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF ACLs with XSS prevention rules.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-56</code></td>
-            <td class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF ACLs with XSS prevention rules.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-57</code></td>
-            <td class="col-domain">ADVISORY: Output Encoding — Manual Review Required</td>
-            <td class="finding-details">Output encoding practices cannot be verified via AWS APIs. Manual code review required.</td>
-            <td class="resolution-text">1. HTML-encode GenAI outputs before rendering in web UIs.
-2. Use parameterized queries when GenAI output is used in database operations.
-3. JSON-encode outputs before embedding in JavaScript contexts.
-4. Validate output length and format before passing to downstream APIs.</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-56</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional WAF Web ACLs found.</p></div>
+                        <div><strong>Resolution</strong><p>Create WAF ACLs with XSS prevention rules.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-57</code></td>
-            <td class="col-domain">ADVISORY: Output Encoding — Manual Review Required</td>
-            <td class="finding-details">Output encoding practices cannot be verified via AWS APIs. Manual code review required.</td>
-            <td class="resolution-text">1. HTML-encode GenAI outputs before rendering in web UIs.
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Output Encoding — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Output encoding practices cannot be verified via AWS APIs. Manual code review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. HTML-encode GenAI outputs before rendering in web UIs.
 2. Use parameterized queries when GenAI output is used in database operations.
 3. JSON-encode outputs before embedding in JavaScript contexts.
-4. Validate output length and format before passing to downstream APIs.</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Validate output length and format before passing to downstream APIs.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-58</code></td>
-            <td class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</td>
-            <td class="finding-details">Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</td>
-            <td class="resolution-text">1. Use Bedrock structured output (response schemas) where supported.
-2. Implement JSON schema validation on Lambda output processors.
-3. Reject malformed outputs and return safe error responses.
-4. Log schema validation failures to CloudWatch for monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-58</code></td>
-            <td class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</td>
-            <td class="finding-details">Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</td>
-            <td class="resolution-text">1. Use Bedrock structured output (response schemas) where supported.
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use Bedrock structured output (response schemas) where supported.
 2. Implement JSON schema validation on Lambda output processors.
 3. Reject malformed outputs and return safe error responses.
-4. Log schema validation failures to CloudWatch for monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Log schema validation failures to CloudWatch for monitoring.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-59</code></td>
-            <td class="col-domain">Topic Restrictions Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only; the STANDARD tier (GA June 2025) adds broader language support for off-topic detection.</td>
-            <td class="resolution-text">For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-59</code></td>
-            <td class="col-domain">Topic Restrictions Configured on CLASSIC Tier</td>
-            <td class="finding-details">Guardrails with topic policies: nist-ai-rmf-guardrail. The following use the CLASSIC tier: nist-ai-rmf-guardrail. CLASSIC tier supports English, French, and Spanish only; the STANDARD tier (GA June 2025) adds broader language support for off-topic detection.</td>
-            <td class="resolution-text">For multilingual FinServ deployments, consider upgrading denied topics to the STANDARD tier (topicsTierConfig.tierName=STANDARD via UpdateGuardrail; requires a cross-region inference profile).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-60</code></td>
-            <td class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</td>
-            <td class="finding-details">Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</td>
-            <td class="resolution-text">1. Include explicit scope instructions in system prompts.
-2. Use Bedrock Guardrails relevance grounding filter.
-3. Test with off-topic prompts in QA to verify rejection behavior.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">COULD NOT ASSESS: Guardrail Topic Allowlist Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</p></div>
+                        <div><strong>Resolution</strong><p>1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
+2. Confirm the service/feature is supported in the assessed region.
+3. Ensure botocore meets the version floor in requirements.txt.
+4. Re-run the assessment; assess this control manually until it succeeds.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>FS-60</code></td>
-            <td class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</td>
-            <td class="finding-details">Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</td>
-            <td class="resolution-text">1. Include explicit scope instructions in system prompts.
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</p></div>
+                        <div><strong>Resolution</strong><p>1. Include explicit scope instructions in system prompts.
 2. Use Bedrock Guardrails relevance grounding filter.
-3. Test with off-topic prompts in QA to verify rejection behavior.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Test with off-topic prompts in QA to verify rejection behavior.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-61</code></td>
-            <td class="col-domain">No Automated KB Sync Schedules Detected</td>
-            <td class="finding-details">Found 3 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</td>
-            <td class="resolution-text">1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
-2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
-3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
-4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-61</code></td>
-            <td class="col-domain">No Automated KB Sync Schedules Detected</td>
-            <td class="finding-details">Found 3 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</td>
-            <td class="resolution-text">1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
+            <td class="finding-summary">
+                <div class="col-domain">No Automated KB Sync Schedules Detected</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</p></div>
+                        <div><strong>Resolution</strong><p>1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
 2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
 3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
-4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-62</code></td>
-            <td class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
-2. Expose KB last sync timestamp in application responses.
-3. Alert users when KB data is older than defined threshold.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-62</code></td>
-            <td class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
+            <td class="finding-summary">
+                <div class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</p></div>
+                        <div><strong>Resolution</strong><p>1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
 2. Expose KB last sync timestamp in application responses.
-3. Alert users when KB data is older than defined threshold.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Alert users when KB data is older than defined threshold.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-63</code></td>
-            <td class="col-domain">Foundation Model Lifecycle Management</td>
-            <td class="finding-details">No legacy models detected. 10 lifecycle-related Config rule(s) found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-63</code></td>
-            <td class="col-domain">Foundation Model Lifecycle Management</td>
-            <td class="finding-details">No legacy models detected. 10 lifecycle-related Config rule(s) found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Foundation Model Lifecycle Management</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No legacy models detected. 11 lifecycle-related Config rule(s) found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-65</code></td>
-            <td class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</td>
-            <td class="finding-details">The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
-- semiconductor-demo-9999
-- 111122223333-us-east-1-kb-data-bucket</td>
-            <td class="resolution-text">1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
-2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
-3. Integrate alerts into your security incident response workflow.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-65</code></td>
-            <td class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</td>
-            <td class="finding-details">The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
-- semiconductor-demo-9999
-- 111122223333-us-east-1-kb-data-bucket</td>
-            <td class="resolution-text">1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
+            <td class="finding-summary">
+                <div class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
+- sat2-prowler-2025-prowlerfindingsbucket-wc1k0mza7lpk</p></div>
+                        <div><strong>Resolution</strong><p>1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
 2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
-3. Integrate alerts into your security incident response workflow.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+3. Integrate alerts into your security incident response workflow.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-66</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing End-User Identity Propagation</td>
-            <td class="finding-details">The following runtimes have no JWT or IAM authorizer configured for end-user identity propagation. Tool calls are authorized only by the agent execution role, not the originating user:
-- origami_expeditions
-- neoCyan_Agent
-- customer_support_agent
-- cdk_agent_core
-- awsapimcpserver</td>
-            <td class="resolution-text">1. Configure a custom JWT authorizer or IAM authorizer on each AgentCore runtime.
-2. Propagate the end-user's identity token to downstream tool services.
-3. Ensure tool services validate the propagated identity before executing actions.
-4. Do not expose propagated identity tokens to unauthorized third parties.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">No AgentCore Runtimes Found</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore runtimes found; identity propagation check not applicable.</p></div>
+                        <div><strong>Resolution</strong><p>If using AgentCore, configure token propagation so end-user identities are forwarded to tool services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-67</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
+- aiml-security-aiml-security-mgmt-FinServAssessment
+- aiml-security-aiml-security-mgmt-AgentCoreAssessment
+- aiml-security-aiml-security-mgmt-BedrockAssessment</p></div>
+                        <div><strong>Resolution</strong><p>1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
+2. Implement threshold enforcement logic in the Lambda handler.
+3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
+4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-68</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">API Gateway Request Body Size Limits — Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No API Gateway REST APIs and no regional WAF Web ACLs were found in this region. There is no input-payload surface to assess for body-size limits.</p></div>
+                        <div><strong>Resolution</strong><p>If GenAI endpoints are fronted by API Gateway or WAF in another region, run the assessment there. Otherwise no action is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-size-constraint.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>FS-69</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Input Validation Functions Present</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Found 1 Lambda function(s) with input validation/sanitization naming patterns: aiml-security-aiml-security-mgmt-CleanupBucket.</p></div>
+                        <div><strong>Resolution</strong><p>Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>FS-66</code></td>
-            <td class="col-domain">AgentCore Runtimes Missing End-User Identity Propagation</td>
-            <td class="finding-details">The following runtimes have no JWT or IAM authorizer configured for end-user identity propagation. Tool calls are authorized only by the agent execution role, not the originating user:
-- origami_expeditions
-- neoCyan_Agent
-- customer_support_agent
-- cdk_agent_core
-- awsapimcpserver</td>
-            <td class="resolution-text">1. Configure a custom JWT authorizer or IAM authorizer on each AgentCore runtime.
-2. Propagate the end-user's identity token to downstream tool services.
-3. Ensure tool services validate the propagated identity before executing actions.
-4. Do not expose propagated identity tokens to unauthorized third parties.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>FS-00</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+            <td><code>777788889999</code></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>FS-00</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AmazonBedrockFullAccess role check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' has AmazonBedrockFullAccess policy attached</p></div>
+                        <div><strong>Resolution</strong><p>Limit the AmazonBedrockFullAccess policy only to required access</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
+https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-67</code></td>
-            <td class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</td>
-            <td class="finding-details">The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
-- aiml-security-aiml-security-111122223333-FinServAssessment
-- aiml-security-aiml-security-111122223333-BedrockAssessment
-- resco-aiml-BedrockAssessment
-- aiml-security-aiml-security-111122223333-AgentCoreAssessment
-- e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk
-- e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII
-- resco-aiml-AgentCoreAssessment</td>
-            <td class="resolution-text">1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
-2. Implement threshold enforcement logic in the Lambda handler.
-3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
-4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' has overly permissive marketplace subscription access through policy 'AmazonBedrockFullAccess'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-67</code></td>
-            <td class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</td>
-            <td class="finding-details">The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
-- aiml-security-aiml-security-111122223333-FinServAssessment
-- aiml-security-aiml-security-111122223333-BedrockAssessment
-- resco-aiml-BedrockAssessment
-- aiml-security-aiml-security-111122223333-AgentCoreAssessment
-- e2ebedrockrag-OSSInfraStack-BKBOSSInfraSetupLambda-031La8JAQXtk
-- e2ebedrockrag-OSSInfraSta-OSSIndexCreationProvider-g56en9UzRjII
-- resco-aiml-AgentCoreAssessment</td>
-            <td class="resolution-text">1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
-2. Implement threshold enforcement logic in the Lambda handler.
-3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
-4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'aiml-sec-test-resources-MarketplaceOverlyPermissive-igL3hGIapee1' has overly permissive marketplace subscription access through policy 'OverlyPermissiveMarketplace'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-68</code></td>
-            <td class="col-domain">API Gateway Request Body Size Limits Not Enforced</td>
-            <td class="finding-details">Found 3 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Add a maxLength (or maxItems/maxProperties) bound to the request-body JSON-Schema model used by your request validator, so oversized prompts are rejected with a 400.
-2. Add a WAF SizeConstraintStatement on the request Body sized within WAF's body-inspection window (default 16 KB; raise via the web ACL AssociationConfig, or set OversizeHandling=MATCH to block bodies beyond the window), and associate the ACL with the API stage.
-3. Set the max_tokens parameter in Bedrock API calls to cap output length.
-4. Implement client-side token counting before submitting requests.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="Global">
+            <td><code>777788889999</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'ProwlerApp-EC2-Role' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkMulticontainerDocker'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-68</code></td>
-            <td class="col-domain">API Gateway Request Body Size Limits Not Enforced</td>
-            <td class="finding-details">Found 3 REST API(s) and 0 regional WAF Web ACL(s), but none enforce a maximum request-body size. Note: an API Gateway request validator does NOT cap body size (it validates the schema and required params; the REST limit is a fixed 10 MB), and a WAF body SizeConstraint only inspects the first ~16 KB of the body by default. Oversized prompts can exhaust Bedrock token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Add a maxLength (or maxItems/maxProperties) bound to the request-body JSON-Schema model used by your request validator, so oversized prompts are rejected with a 400.
-2. Add a WAF SizeConstraintStatement on the request Body sized within WAF's body-inspection window (default 16 KB; raise via the web ACL AssociationConfig, or set OversizeHandling=MATCH to block bodies beyond the window), and associate the ACL with the API stage.
-3. Set the max_tokens parameter in Bedrock API calls to cap output length.
-4. Implement client-side token counting before submitting requests.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock VPC endpoints found: VPC vpc-089a9d593e34658c6 has endpoint com.amazonaws.us-east-1.bedrock-runtime</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging is not enabled. This limits your ability to track and audit model usage.</p></div>
+                        <div><strong>Resolution</strong><p>Enable model invocation logging to collect invocation logs, model input data, and model output data. Configure logging to deliver to Amazon S3, CloudWatch Logs, or both for comprehensive monitoring.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-east-1">
-            <td><code>111122223333</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-69</code></td>
-            <td class="col-domain">Prompt Input Validation Functions Present</td>
-            <td class="finding-details">Found 3 Lambda function(s) with input validation/sanitization naming patterns: resco-aiml-CleanupBucket, visa-bulletin-tracker-prod-cleanup, aiml-security-aiml-security-111122223333-CleanupBucket.</td>
-            <td class="resolution-text">Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon Bedrock Guardrails are properly configured with 1 guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue monitoring and updating guardrails as needed.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue monitoring CloudTrail logs for Bedrock activity.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="111122223333" data-region="us-west-2">
-            <td><code>111122223333</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-69</code></td>
-            <td class="col-domain">Prompt Input Validation Functions Present</td>
-            <td class="finding-details">Found 3 Lambda function(s) with input validation/sanitization naming patterns: resco-aiml-CleanupBucket, visa-bulletin-tracker-prod-cleanup, aiml-security-aiml-security-111122223333-CleanupBucket.</td>
-            <td class="resolution-text">Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management is being used with 1 prompts</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue using Prompt Management for consistent and optimized prompts.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="eu-west-1">
-            <td><code>111122223333</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="ap-south-1">
-            <td><code>111122223333</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="111122223333" data-region="sa-east-1">
-            <td><code>111122223333</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-east-1">
-            <td><code>444455556666</code></td>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Error during check: An error occurred (AccessDeniedException) when calling the GetAgent operation: You do not have sufficient permissions to the key. Check credentials for appropriate permissions to the key (kms:Decrypt, kms:GenerateDataKey) and try again.</p></div>
+                        <div><strong>Resolution</strong><p>Investigate error and retry assessment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="us-west-2">
-            <td><code>444455556666</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge Base 'knowledge-base-prowler-findings' (9K2QZLVCZW) uses 'OPENSEARCH_SERVERLESS' storage. Encryption is managed at the storage layer and cannot be validated from the KB API. Verify encryption configuration on the underlying storage resource.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: Verify encryption with CMK at collection level
+2. For S3 data sources: Verify CMK-encrypted S3 buckets
+3. For RDS: Verify KMS encryption on the database
+4. Consider using CMK for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="eu-west-1">
-            <td><code>444455556666</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following roles can invoke Bedrock models without enforced guardrails: aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G, aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a, aiml-sec-test-resources-BedrockKnowledgeBaseRole-6NNC1i9FuTbM, AmazonBedrockExecutionRoleForKnowledgeBase_7erx6, ProwlerApp-EC2-Role</p></div>
+                        <div><strong>Resolution</strong><p>Add IAM policy conditions to enforce guardrail usage:
+1. Use 'bedrock:GuardrailIdentifier' condition key
+2. Specify required guardrail ARN or ID
+3. Example: "Condition": {"StringEquals": {"bedrock:GuardrailIdentifier": "arn:aws:bedrock:region:account:guardrail/guardrail-id"}}</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="ap-south-1">
-            <td><code>444455556666</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="444455556666" data-region="sa-east-1">
-            <td><code>444455556666</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+            <td><code>777788889999</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">AWS Shield Advanced Not Enabled</td>
-            <td class="finding-details">AWS Shield Advanced is not subscribed. GenAI API endpoints are vulnerable to volumetric DDoS attacks that can exhaust token quotas and inflate costs.</td>
-            <td class="resolution-text">1. Subscribe to AWS Shield Advanced for DDoS protection.
-2. After subscribing, explicitly add resource protections in the Shield Advanced console for each Bedrock-facing resource (API Gateway stages, ALBs, CloudFront distributions, Route 53 hosted zones). Shield Advanced subscription alone does NOT automatically protect resources — each resource must be individually added to receive protection.
-3. Enable Shield Response Team (SRT) access and configure proactive engagement.
-4. Alternatively, use AWS Firewall Manager with a Shield Advanced policy to automate resource protection based on tags or resource types.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="Global">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-01</code></td>
-            <td class="col-domain">No Regional WAF Web ACLs Found</td>
-            <td class="finding-details">No AWS WAF regional Web ACLs found. Without WAF, GenAI endpoints lack rate-based rules to block abusive callers.</td>
-            <td class="resolution-text">1. Create a WAF Web ACL with rate-based rules (e.g., 1000 req/5 min per IP).
-2. Associate the ACL with API Gateway stages or ALBs fronting Bedrock.
-3. Add AWS Managed Rules for known bad inputs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>BR-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Cross-Account Guardrails Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Check must run in AWS Organizations management account to evaluate organizational policies</p></div>
+                        <div><strong>Resolution</strong><p>Run assessment in management account to check cross-account guardrails enforcement</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-02</code></td>
-            <td class="col-domain">No API Gateway Usage Plans Found</td>
-            <td class="finding-details">No usage plans configured. GenAI API endpoints may have no rate limits.</td>
-            <td class="resolution-text">Create API Gateway usage plans with throttle settings (rateLimit and burstLimit) for all Bedrock-facing APIs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</p></div>
+                        <div><strong>Resolution</strong><p>Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-03</code></td>
-            <td class="col-domain">Bedrock Token Quotas Customized</td>
-            <td class="finding-details">Found 236 Bedrock token-based quota(s); at least one applied value exceeds the AWS default, indicating quotas have been reviewed and raised.</td>
-            <td class="resolution-text">No action required. Periodically re-review quotas against expected peak load.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-04</code></td>
-            <td class="col-domain">No Cost Anomaly Detection Monitors</td>
-            <td class="finding-details">No AWS Cost Anomaly Detection monitors found. Unexpected spikes in Bedrock/SageMaker usage (e.g., from prompt injection loops) will go undetected.</td>
-            <td class="resolution-text">1. Create a Cost Anomaly Detection monitor scoped to AWS/Bedrock and AWS/SageMaker.
-2. Configure alert subscriptions (SNS/email) for anomalies above threshold.
-3. Set daily spend budgets with AWS Budgets as a secondary control.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/getting-started-ad.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</p></div>
+                        <div><strong>Resolution</strong><p>Create model evaluation jobs using Amazon Bedrock Evaluations to assess foundation model performance against safety and quality metrics. Use built-in datasets or custom test sets. Enable LLM-as-a-judge evaluation for comprehensive assessment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-05</code></td>
-            <td class="col-domain">No Bedrock CloudWatch Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for Bedrock metrics. Token exhaustion and throttling events will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms for:
-- AWS/Bedrock InvocationThrottles (threshold > 0)
-- AWS/Bedrock TokensProcessed (threshold based on quota)
-- Custom application-level token counters via EMF</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-06</code></td>
-            <td class="col-domain">No AI/ML Service Budgets Configured</td>
-            <td class="finding-details">No AWS Budgets found scoped to Bedrock or SageMaker. Unbounded GenAI spend can go undetected until the monthly bill.</td>
-            <td class="resolution-text">1. Create cost budgets for AWS Bedrock and SageMaker with 80%/100% alert thresholds.
-2. Add SNS notifications to on-call channels.
-3. Consider budget actions to apply IAM deny policies when thresholds are breached.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Review</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-prowler-findings' (ID: 9K2QZLVCZW) uses 'OPENSEARCH_SERVERLESS' storage. The vector-store encryption key is managed at the storage layer and cannot be validated from the Knowledge Base API. Verify customer-managed KMS encryption on the underlying store.</p></div>
+                        <div><strong>Resolution</strong><p>1. For OpenSearch Serverless: verify the collection uses a customer-managed KMS key
+2. For Amazon RDS/Aurora: verify KMS encryption on the database
+3. For third-party stores (Pinecone, Redis, MongoDB): verify the provider's encryption configuration
+4. Verify the customer-managed KMS key used for transient data during ingestion</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-07</code></td>
-            <td class="col-domain">Agent Action Boundaries Look Appropriate</td>
-            <td class="finding-details">Reviewed 1 agent(s); no wildcard sensitive actions found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>9 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</p></div>
+                        <div><strong>Resolution</strong><p>Continue monitoring quota utilization. Review and adjust quotas as application requirements change.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-08</code></td>
-            <td class="col-domain">No AgentCore Runtimes Found</td>
-            <td class="finding-details">No AgentCore runtimes found; policy engine check not applicable.</td>
-            <td class="resolution-text">If using AgentCore, configure the Policy Engine to authorize tool calls.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</p></div>
+                        <div><strong>Resolution</strong><p>Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-09</code></td>
-            <td class="col-domain">Agent Lambda Functions Without Concurrency Limits</td>
-            <td class="finding-details">Agent-related Lambda functions without reserved concurrency: aiml-security-aiml-security-mgmt-FinServAssessment, aiml-sec-test-resources-SageMakerJobCustomResource-ZA5QCAi0pN3d, AIMLSecurityAssessment-CodeBuildStartBuildLambda-VYOqtzWoNo3m, aiml-security-aiml-security-mgmt-CleanupBucket, aiml-security-aiml-security-mgmt-SagemakerAssessment, aiml-security-aiml-security-mgmt-GenerateReport, aiml-security-aiml-security-mgmt-IAMPermissionCaching, aiml-security-aiml-security-mgmt-AgentCoreAssessment, aiml-security-aiml-security-mgmt-BedrockAssessment, aiml-security-aiml-security-mgmt-ResolveRegions. Unlimited concurrency allows runaway agent loops to exhaust account limits.</td>
-            <td class="resolution-text">1. Set reserved concurrency on agent Lambda functions.
-2. Implement maximum iteration counts in agent orchestration logic.
-3. Use Step Functions with MaxConcurrency and timeout states.
-4. Add circuit-breaker patterns to agent tool invocations.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Knowledge base 'knowledge-base-prowler-findings' (ID: 9K2QZLVCZW) does not have recent RAG evaluation jobs. RAG evaluations assess context relevance, response correctness, faithfulness, and harmfulness to prevent hallucinations.</p></div>
+                        <div><strong>Resolution</strong><p>Create RAG evaluation jobs for knowledge bases using Amazon Bedrock Model Evaluation. Configure evaluations to test context relevance, answer correctness, and faithfulness metrics. Run evaluations regularly (monthly or after significant KB updates) to maintain quality.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-10</code></td>
-            <td class="col-domain">Human-in-the-Loop Check — No Agent Workflows Found</td>
-            <td class="finding-details">No Step Functions state machines with agent/approval naming found. Verify that high-risk agent actions (e.g., fund transfers, account changes) have human approval gates.</td>
-            <td class="resolution-text">Implement Step Functions .waitForTaskToken patterns for high-risk agent actions. Route approval requests to human reviewers via SNS/SES/Slack.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</p></div>
+                        <div><strong>Resolution</strong><p>Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-11</code></td>
-            <td class="col-domain">No Agent Rate Alarms Found</td>
-            <td class="finding-details">No CloudWatch alarms found for agent invocation rates. Looping or runaway agents will not trigger operational alerts.</td>
-            <td class="resolution-text">Create CloudWatch alarms on:
-- Bedrock agent invocation counts (threshold based on expected max)
-- Lambda invocation errors for agent functions
-- Step Functions execution failures and timeouts</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cw.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</p></div>
+                        <div><strong>Resolution</strong><p>Retry the assessment. If the error persists, grant bedrock:GetGuardrail and verify the guardrail still exists.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-12</code></td>
-            <td class="col-domain">No Bedrock-Scoped SCPs Found</td>
-            <td class="finding-details">No Service Control Policies reference Bedrock. Without SCPs, any account in the organization can access any Bedrock model, including unapproved third-party models.</td>
-            <td class="resolution-text">1. Create an SCP that denies bedrock:InvokeModel for model IDs not on the approved list.
-2. Use bedrock:ModelId condition key to allowlist approved models.
-3. Maintain a model inventory and update the SCP when models are approved/retired.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>1 agents have an associated guardrail</p></div>
+                        <div><strong>Resolution</strong><p>No action required. Continue associating guardrails with new agents.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-13</code></td>
-            <td class="col-domain">Models Missing Provenance Tags</td>
-            <td class="finding-details">2 model(s) missing required provenance tags:
-- SageMaker model 'SageMakerModelWithIsolation-JASFpUHjajdk' missing tags: {'version', 'approval-date', 'source'}
-- SageMaker model 'SageMakerModelNoIsolation-yQ7EpJeL7pgI' missing tags: {'version', 'approval-date', 'source'}</td>
-            <td class="resolution-text">Tag all models with: source (e.g., 'aws-marketplace', 'internal'), version, and approval-date. Enforce tagging via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-14</code></td>
-            <td class="col-domain">Model Governance Config Rules Present</td>
-            <td class="finding-details">Found 13 model-related Config rule(s).</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-15</code></td>
-            <td class="col-domain">No Bedrock Evaluation Jobs Found</td>
-            <td class="finding-details">No Bedrock Model Evaluation jobs found. Models have not been evaluated for adversarial robustness. FinServ model-risk management (SR 11-7) expects documented model validation/evaluation.</td>
-            <td class="resolution-text">1. Run Bedrock Model Evaluation with adversarial/red-team datasets.
-2. Use FMEval library for automated robustness testing.
-3. Schedule periodic re-evaluation after model updates.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>Create CloudWatch alarms on AWS/Bedrock runtime metrics such as Invocations, InvocationThrottles, InputTokenCount, OutputTokenCount, and ContentFilteredCount, and route them to an Amazon SNS topic for notification.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-16</code></td>
-            <td class="col-domain">ECR Repositories Without Image Scanning</td>
-            <td class="finding-details">2 ECR repo(s) without scan-on-push: cdk-hnb659fds-container-assets-777788889999-us-east-1, aiml-sec-test-agentcore-no-encryption.</td>
-            <td class="resolution-text">Enable scan-on-push for all ECR repositories containing model containers. Consider enabling Enhanced Scanning (Inspector) for CVE detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>AG-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: Model invocation logging is not enabled. This limits your ability to track and audit model usage.</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-20</code></td>
-            <td class="col-domain">Feature Groups Without Offline Store</td>
-            <td class="finding-details">1 feature group(s) lack an active offline store: aiml-sec-test-feature-group. Without offline store, historical feature data cannot be used for rollback.</td>
-            <td class="resolution-text">1. Enable offline store (S3-backed) for all production feature groups.
-2. Enable S3 versioning on the offline store bucket.
-3. Document rollback procedures for poisoned feature data.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-offline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: CloudTrail is properly configured to log Bedrock API activity in trails: IsengardTrail-DO-NOT-DELETE</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="Global">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-21</code></td>
-            <td class="col-domain">Training Data Buckets Have Versioning</td>
-            <td class="finding-details">All 2 training bucket(s) have versioning enabled.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>Global</code></td>
+            <td><code>AG-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Guardrail Enforcement Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Check must run in AWS Organizations management account to evaluate organizational policies</p></div>
+                        <div><strong>Resolution</strong><p>Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-22</code></td>
-            <td class="col-domain">Overly Permissive Knowledge Base IAM Roles</td>
-            <td class="finding-details">823 role(s) with wildcard KB permissions:
-- Role 'Admin' allows '*'
-- Role 'aiml-sec-test-resources-BedrockAgentRole-RScmoTZfp2sC' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockAgentRole-RScmoTZfp2sC' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G' allows 'bedrock:InvokeModel' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockAgentRoleWithoutGuar-Z3kN5ANhP89G' allows 'bedrock:InvokeModelWithResponseStream' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-sec-test-resources-BedrockFullAccessRole-zAFkGLkWQ61a' allows 'bedrock:*'
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:ListGuardrails' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:GetGuardrail' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:ListModelInvocationJobs' on Resource '*' (no ARN scoping to specific Knowledge Bases)
-- Role 'aiml-security-mgmt-BedrockSecurityAssessmentFunctio-a7GKJ6O4151K' allows 'bedrock:GetModelInvocationLoggingConfiguration' on Resource '*' (no ARN scoping to specific Knowledge Bases)</td>
-            <td class="resolution-text">Replace wildcard bedrock:* with specific actions such as bedrock:Retrieve, bedrock:RetrieveAndGenerate. Scope resources to specific Knowledge Base ARNs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>AG-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No Bedrock model evaluation jobs found. Model evaluation helps assess toxicity, accuracy, semantic robustness, and other safety metrics before production deployment.</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status error">Failed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-24</code></td>
-            <td class="col-domain">ADVISORY: Knowledge Base Metadata Filtering — Manual Review Required</td>
-            <td class="finding-details">Found 1 Knowledge Base(s). Tenant-isolation metadata filtering is a design pattern that cannot be verified via API — manual review required. Verify that metadata attributes (e.g., tenantId, classification) are indexed and that Retrieve calls include RetrievalFilter conditions for tenant isolation.</td>
-            <td class="resolution-text">1. Add metadata fields (tenantId, dataClassification) to KB data sources.
-2. Pass RetrievalFilter in all Retrieve/RetrieveAndGenerate calls.
-3. Validate filters in integration tests to prevent cross-tenant data leakage.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-25</code></td>
-            <td class="col-domain">OpenSearch Serverless Encryption Policies Present</td>
-            <td class="finding-details">Found 1 encryption policy(ies); 1 use a customer-managed KMS key.</td>
-            <td class="resolution-text">Verify all vector store collections use customer-managed KMS keys.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
+            <td><code>AG-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: 9 custom throttling quotas are configured. Regular quota review helps maintain appropriate rate limits.</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-26</code></td>
-            <td class="col-domain">OpenSearch Serverless Collections Not VPC-Restricted</td>
-            <td class="finding-details">Found 1 network policy(ies) but none restrict to VPC. Vector stores may be accessible from the public internet.</td>
-            <td class="resolution-text">Update network policies to allow access only from VPC endpoints. Create an OpenSearch Serverless VPC endpoint in your VPC.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>AG-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-27</code></td>
-            <td class="col-domain">No Automated Reasoning Policies Found</td>
-            <td class="finding-details">No Bedrock Automated Reasoning policies have been created. ARC (GA August 2025) uses formal verification to guarantee that GenAI outputs comply with authored business rules — e.g., loan criteria, regulatory thresholds, policy constraints. Without ARC policies, factual accuracy of outputs is not formally verified, only heuristically filtered by contextual grounding thresholds.</td>
-            <td class="resolution-text">1. In the Amazon Bedrock console → Guardrails → Automated Reasoning, create a policy document encoding your FinServ business rules (e.g., eligibility criteria, rate limits, regulatory thresholds).
-2. Associate the ARC policy with your guardrail (automatedReasoningPolicy.policies field in CreateGuardrail/UpdateGuardrail).
-3. Set confidenceThreshold on the policy to control strictness.
-4. ARC requires cross-Region inference — ensure your guardrail has a guardrailProfileArn configured (crossRegionDetails in GetGuardrail response).
-5. Reference: AWS Announcement — Automated Reasoning checks GA (August 2025).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>AG-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: Guardrail 'aiml-sec-test-test-guardrail' (ID: jkceg2tprvwh) could not be assessed because GetGuardrail returned AccessDeniedException.</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="low" data-status="passed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-28</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Financial Denied Topics Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: 1 agents have an associated guardrail</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
             <td><code>777788889999</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>FS-29</code></td>
-            <td class="col-domain">ADVISORY: Compliance Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level compliance disclaimers cannot be verified via AWS APIs. Manual review required to confirm GenAI outputs include required regulatory disclosures.</td>
-            <td class="resolution-text">1. Implement post-processing to append required disclaimers to GenAI outputs.
-2. Use Bedrock Guardrails word filters to block outputs that omit required disclosures.
-3. Document disclaimer requirements in the AI use case register.
-4. Test disclaimer presence in QA/UAT before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No CloudWatch alarms are configured on Amazon Bedrock runtime metrics (AWS/Bedrock namespace). Without alarms, abuse, denial-of-wallet, sustained throttling, and content-filter spikes can go undetected.</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-30</code></td>
-            <td class="col-domain">ADVISORY: Compliance Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include compliance-specific datasets (fair lending/ECOA, Fair Housing Act, UDAP/UDAAP, AML/KYC edge cases). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with compliance-specific datasets:
-- Fair lending test cases (ECOA, Fair Housing Act)
-- UDAP/UDAAP unfair/deceptive practice scenarios
-- AML/KYC edge cases</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-31</code></td>
-            <td class="col-domain">Knowledge Base Data Sources Past Review Threshold</td>
-            <td class="finding-details">1 data source(s) not synced in >7 days (a configurable review threshold, NOT an AWS-mandated limit):
-- KB 'knowledge-base-prowler-findings' source 'knowledge-base-quick-start-9lb68-data-source' last synced 423 days ago
-Confirm this age is acceptable for each data source's currency requirement — slow-changing reference data may legitimately sync infrequently.</td>
-            <td class="resolution-text">1. Define the maximum acceptable data age per use case (e.g., intraday for market data, daily for product terms, weekly/monthly for regulatory guidance) and adjust the review threshold to match.
-2. Configure automated sync (EventBridge Scheduler → StartIngestionJob) at that cadence — see FS-61.
-3. Set CloudWatch alarms on sync job failures.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-32</code></td>
-            <td class="col-domain">ADVISORY: Source Attribution — Manual Review Required</td>
-            <td class="finding-details">Source attribution in GenAI responses cannot be verified via AWS APIs. Manual review required to confirm responses include citations.</td>
-            <td class="resolution-text">1. Use Bedrock RetrieveAndGenerate with citations enabled.
-2. Include source document references in response post-processing.
-3. Test citation accuracy in QA before production deployment.
-4. Consider Bedrock Guardrails grounding checks to validate response accuracy.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-33</code></td>
-            <td class="col-domain">KB Data Source Buckets Have Versioning</td>
-            <td class="finding-details">All reviewed KB data source buckets have versioning enabled.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/checking-object-integrity.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
+1. Create and version your prompts
+2. Test different prompt variants
+3. Share prompts across your organization
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-34</code></td>
-            <td class="col-domain">Legacy Foundation Models Available in Region</td>
-            <td class="finding-details">Legacy/deprecated foundation models are available in this account/region: anthropic.claude-sonnet-4-20250514-v1:0, twelvelabs.marengo-embed-2-7-v1:0, anthropic.claude-opus-4-1-20250805-v1:0, amazon.nova-premier-v1:0:8k, amazon.nova-premier-v1:0:20k, amazon.nova-premier-v1:0:1000k, amazon.nova-premier-v1:0:mm, amazon.nova-premier-v1:0, amazon.nova-canvas-v1:0, amazon.nova-reel-v1:0. This API reports model *availability*, not actual usage — it cannot determine which models your applications invoke. Legacy models have older training-data cutoffs and may produce outdated information if used. Review whether any are in active use.</td>
-            <td class="resolution-text">1. Identify which (if any) of these legacy models your applications invoke (e.g., via CloudTrail InvokeModel events or application config).
-2. Migrate active usage to current model versions.
-3. Document training-data cutoff dates for all models in use.
-4. Add data-currency disclaimers to outputs from models with old cutoffs.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-35</code></td>
-            <td class="col-domain">ADVISORY: Harmful-Content Test Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation/FMEval jobs include harmful-content datasets (toxicity, hate speech, violence/self-harm). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation or FMEval with harmful content datasets:
-- Toxicity detection
-- Hate speech classification
-- Violence/self-harm content</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-36</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Content Filters Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-37</code></td>
-            <td class="col-domain">ADVISORY: User Feedback Mechanism — Manual Review Required</td>
-            <td class="finding-details">User feedback mechanisms for harmful outputs cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Implement thumbs-up/down or flag-for-review UI in GenAI applications.
-2. Route flagged outputs to human reviewers via SQS/SNS.
-3. Log feedback to DynamoDB/S3 for model improvement.
-4. Define SLAs for reviewing flagged content.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-38</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Word Filters Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-39</code></td>
-            <td class="col-domain">No SageMaker Clarify Bias Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify model bias monitoring schedules found. Models making financial decisions (credit, insurance) may exhibit discriminatory bias without detection.</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify bias detection for all models making credit, insurance, or employment decisions.
-2. Define protected attributes (age, gender, race proxies).
-3. Set bias metric thresholds and alert on violations.
-4. Document bias testing results for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-monitor-bias-drift.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-40</code></td>
-            <td class="col-domain">ADVISORY: Bias Dataset Coverage — Manual Review Required</td>
-            <td class="finding-details">Bedrock model-evaluation dataset content cannot be inspected via API. Manually verify your model-evaluation jobs include bias/fairness datasets (demographic parity, equal-opportunity, counterfactual fairness) for any GenAI models used in financial decisions (ECOA/Fair Housing). Whether any evaluation jobs exist at all is assessed by FS-15.</td>
-            <td class="resolution-text">Run Bedrock Model Evaluation with bias test datasets:
-- Demographic parity test cases
-- Equal opportunity scenarios
-- Counterfactual fairness tests</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-41</code></td>
-            <td class="col-domain">No SageMaker Clarify Explainability Monitoring</td>
-            <td class="finding-details">No SageMaker Clarify explainability monitoring found. Models making adverse financial decisions may not provide required explanations (ECOA adverse action notices).</td>
-            <td class="resolution-text">1. Configure SageMaker Clarify explainability for credit/lending models.
-2. Generate SHAP values for feature importance.
-3. Map top features to human-readable adverse action reason codes.
-4. Store explanations for regulatory examination.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-42</code></td>
-            <td class="col-domain">No SageMaker Model Cards Found</td>
-            <td class="finding-details">No SageMaker Model Cards found. Production AI models lack documented intended use, limitations, and bias evaluations.</td>
-            <td class="resolution-text">1. Create SageMaker Model Cards for all production models.
-2. Document: intended use, out-of-scope uses, training data, bias evaluations.
-3. Include regulatory compliance attestations.
-4. Review and update cards at each model version release.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-43</code></td>
-            <td class="col-domain">No CloudWatch Logs Data Protection Policies</td>
-            <td class="finding-details">No CloudWatch Logs data protection policies found. PII (SSN, account numbers, credit card numbers) in Bedrock invocation logs may be stored in plaintext.</td>
-            <td class="resolution-text">1. Create CloudWatch Logs data protection policies to mask PII.
-2. Enable masking for: SSN, credit card numbers, bank account numbers, email.
-3. Apply policies to Bedrock invocation log groups.
-4. Test masking with synthetic PII before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-44</code></td>
-            <td class="col-domain">Amazon Macie Not Enabled</td>
-            <td class="finding-details">Amazon Macie is not enabled. S3 buckets containing training data and KB data sources are not being scanned for PII/sensitive data.</td>
-            <td class="resolution-text">1. Enable Amazon Macie in all regions where AI/ML data is stored.
-2. Create Macie classification jobs for training data and KB buckets.
-3. Configure Macie findings to route to Security Hub and SNS.
-4. Remediate PII findings before using data for model training.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-45</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail PII Filters Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-46</code></td>
-            <td class="col-domain">AI/ML Buckets Without Data Classification Tags</td>
-            <td class="finding-details">3 AI/ML bucket(s) without data-classification tags: aiml-sec-test-resources-bedrockloggingbucket-wtuvpinrlpmd, aiml-sec-test-resources-sagemakerbucket-6zzmxxaxco6g, aiml-security-mgmt-aimlassessmentbucket-kbitsdgexylv.</td>
-            <td class="resolution-text">Tag all AI/ML data buckets with 'data-classification' key. Values: Public, Internal, Confidential, Restricted. Enforce via SCP or AWS Config rule.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-47</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Grounding Threshold Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-48</code></td>
-            <td class="col-domain">Active Knowledge Bases for RAG Present</td>
-            <td class="finding-details">Found 1 active Knowledge Base(s) for RAG grounding.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-26</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+            <td><code>777788889999</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-27</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-49</code></td>
-            <td class="col-domain">ADVISORY: Hallucination Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Application-level hallucination disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add disclaimers to GenAI outputs: 'AI-generated content may contain errors. Verify with authoritative sources before acting.'
-2. Implement post-processing to append disclaimers.
-3. Test disclaimer presence in QA before production.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-28</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-50</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Relevance Grounding Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-29</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-51</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Prompt Injection Input Validation Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-30</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-52</code></td>
-            <td class="col-domain">Bedrock Lambda Functions on Current Runtimes</td>
-            <td class="finding-details">All 10 Bedrock Lambda function(s) use current runtimes.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-31</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
+            <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-53</code></td>
-            <td class="col-domain">No WAF Web ACLs — Injection Rules Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF Web ACLs with injection protection rules (see FS-01).</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>BR-32</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-54</code></td>
-            <td class="col-domain">ADVISORY: Penetration Testing — Manual Review Required</td>
-            <td class="finding-details">Penetration testing evidence cannot be verified via AWS APIs. Manual review required to confirm GenAI applications have been tested.</td>
-            <td class="resolution-text">1. Conduct penetration testing of GenAI applications at least annually and before major releases.
-2. Include AI-specific test cases: prompt injection, jailbreak, indirect (cross-domain) injection, system-prompt leakage, and data-extraction attempts.
-3. Consider AWS Security Agent for on-demand, AI-driven penetration testing (GA March 2026; available in US East N. Virginia, US West Oregon, Europe Ireland, Europe Frankfurt, Asia Pacific Sydney, Asia Pacific Tokyo, with cross-account shared-VPC testing via AWS RAM). Open-source tools such as Garak or PyRIT and manual red-teaming are complementary options. Verify current regional availability on the AWS Security Agent page before relying on it.
-4. Document findings and remediation for regulatory examination, and tag tested resources with a last-pentest-date for audit trail.
-5. For DORA compliance, include GenAI in TLPT (Threat-Led Penetration Testing) scope.</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/security/penetration-testing/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-55</code></td>
-            <td class="col-domain">No Output Validation Functions Found</td>
-            <td class="finding-details">No Lambda functions with output validation/sanitization naming found. GenAI outputs may be passed directly to downstream systems without validation.</td>
-            <td class="resolution-text">1. Implement output validation Lambda functions in GenAI pipelines.
-2. Validate output schema, length, and content before downstream use.
-3. Sanitize outputs before rendering in web UIs (XSS prevention).
-4. Encode outputs appropriately for the target context (HTML, SQL, JSON).</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-56</code></td>
-            <td class="col-domain">No WAF ACLs — XSS Prevention Not Applicable</td>
-            <td class="finding-details">No regional WAF Web ACLs found.</td>
-            <td class="resolution-text">Create WAF ACLs with XSS prevention rules.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-57</code></td>
-            <td class="col-domain">ADVISORY: Output Encoding — Manual Review Required</td>
-            <td class="finding-details">Output encoding practices cannot be verified via AWS APIs. Manual code review required.</td>
-            <td class="resolution-text">1. HTML-encode GenAI outputs before rendering in web UIs.
-2. Use parameterized queries when GenAI output is used in database operations.
-3. JSON-encode outputs before embedding in JavaScript contexts.
-4. Validate output length and format before passing to downstream APIs.</td>
-            <td class="reference-cell"><a href="https://genai.owasp.org/llm-top-10/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-58</code></td>
-            <td class="col-domain">ADVISORY: Output Schema Validation — Manual Review Required</td>
-            <td class="finding-details">Found 0 Lambda function(s) whose names suggest schema/validation handling. Structured-output / JSON-schema validation of GenAI responses is an application-layer control that cannot be verified automatically — manual review required.</td>
-            <td class="resolution-text">1. Use Bedrock structured output (response schemas) where supported.
-2. Implement JSON schema validation on Lambda output processors.
-3. Reject malformed outputs and return safe error responses.
-4. Log schema validation failures to CloudWatch for monitoring.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/inference-parameters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="low" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-59</code></td>
-            <td class="col-domain">COULD NOT ASSESS: Guardrail Topic Allowlist Check</td>
-            <td class="finding-details">This check could not be completed (error: An error occurred (AccessDeniedException) when calling the GetGuardrail operation: You don't have sufficient permissions to access this guardrail.). The most common cause is a missing IAM permission for the assessment role; it may also indicate an unsupported region or an outdated botocore. This control was NOT assessed — verify the role's permissions and re-run, and assess this control manually until resolved.</td>
-            <td class="resolution-text">1. Confirm the assessment role grants the actions this check requires (see the documented IAM permission set in the README).
-2. Confirm the service/feature is supported in the assessed region.
-3. Ensure botocore meets the version floor in requirements.txt.
-4. Re-run the assessment; assess this control manually until it succeeds.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-60</code></td>
-            <td class="col-domain">ADVISORY: Contextual Grounding for Off-Topic Prevention</td>
-            <td class="finding-details">Contextual grounding for off-topic prevention is covered by guardrail grounding checks (FS-47) and RAG configuration (FS-48). Additionally verify system prompts explicitly scope the assistant's role.</td>
-            <td class="resolution-text">1. Include explicit scope instructions in system prompts.
-2. Use Bedrock Guardrails relevance grounding filter.
-3. Test with off-topic prompts in QA to verify rejection behavior.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-grounding.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-61</code></td>
-            <td class="col-domain">No Automated KB Sync Schedules Detected</td>
-            <td class="finding-details">Found 1 Knowledge Base(s) but no EventBridge Scheduler schedules or EventBridge rules with 'bedrock'/'knowledge' naming were found. Note: this check uses a name/target heuristic — sync automation with other naming conventions, AWS Step Functions-based orchestration, or native Bedrock API-triggered syncs (StartIngestionJob called directly) will not be detected. Verify sync automation manually if applicable.</td>
-            <td class="resolution-text">1. Use EventBridge Scheduler (the AWS-recommended approach) to create a recurring schedule (e.g., rate(1 day) or a cron expression) that triggers a Lambda function calling the Bedrock StartIngestionJob API for each data source. Classic EventBridge scheduled rules also work but are a legacy feature.
-2. As of December 2024, Bedrock Knowledge Bases supports custom connectors and streaming data ingestion — use direct document ingestion (KnowledgeBaseDocuments API) for real-time updates without a full S3 sync.
-3. Set sync frequency based on data currency requirements (e.g., hourly for market data, daily for regulatory guidance).
-4. Configure CloudWatch alarms or SNS notifications on IngestionJob FAILED status for sync failure alerting.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-62</code></td>
-            <td class="col-domain">ADVISORY: Data Currency Disclaimer — Manual Review Required</td>
-            <td class="finding-details">Data currency disclaimers cannot be verified via AWS APIs. Manual review required.</td>
-            <td class="resolution-text">1. Add data currency disclaimers to GenAI outputs: 'Information based on data current as of [KB last sync date].'
-2. Expose KB last sync timestamp in application responses.
-3. Alert users when KB data is older than defined threshold.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base-ingest.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-63</code></td>
-            <td class="col-domain">Foundation Model Lifecycle Management</td>
-            <td class="finding-details">No legacy models detected. 11 lifecycle-related Config rule(s) found.</td>
-            <td class="resolution-text">No action required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="medium" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-65</code></td>
-            <td class="col-domain">KB Data Source Buckets Missing S3 Event Notifications</td>
-            <td class="finding-details">The following KB data-source S3 buckets have no event notifications configured. Unauthorized document modifications will not be detected in real time:
-- sat2-prowler-2025-prowlerfindingsbucket-wc1k0mza7lpk</td>
-            <td class="resolution-text">1. Enable Amazon EventBridge notifications on each KB data-source S3 bucket.
-2. Create an EventBridge rule to route s3:ObjectCreated, s3:ObjectRemoved, and s3:ObjectModified events to an SNS topic or Lambda for alerting.
-3. Integrate alerts into your security incident response workflow.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-66</code></td>
-            <td class="col-domain">No AgentCore Runtimes Found</td>
-            <td class="finding-details">No AgentCore runtimes found; identity propagation check not applicable.</td>
-            <td class="resolution-text">If using AgentCore, configure token propagation so end-user identities are forwarded to tool services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-authorization.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="high" data-status="failed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-67</code></td>
-            <td class="col-domain">Agent Action-Group Lambdas May Lack Transaction Thresholds</td>
-            <td class="finding-details">The following agent action-group Lambda functions have no environment variables whose names suggest transaction-value threshold configuration (this is a best-effort heuristic — a threshold enforced in code or in an AgentCore Policy Engine rule would not be detected here, so treat this as a prompt for manual verification rather than a definitive gap). Without explicit limits, agents could initiate unbounded financial transactions:
-- aiml-security-aiml-security-mgmt-FinServAssessment
-- aiml-security-aiml-security-mgmt-AgentCoreAssessment
-- aiml-security-aiml-security-mgmt-BedrockAssessment</td>
-            <td class="resolution-text">1. Add transaction-value threshold environment variables (e.g., MAX_TRANSACTION_AMOUNT) to each agent action-group Lambda.
-2. Implement threshold enforcement logic in the Lambda handler.
-3. Configure AgentCore Policy Engine rules to cap financial transaction amounts.
-4. Route transactions exceeding thresholds to a human-in-the-loop approval step.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-68</code></td>
-            <td class="col-domain">API Gateway Request Body Size Limits — Not Applicable</td>
-            <td class="finding-details">No API Gateway REST APIs and no regional WAF Web ACLs were found in this region. There is no input-payload surface to assess for body-size limits.</td>
-            <td class="resolution-text">If GenAI endpoints are fronted by API Gateway or WAF in another region, run the assessment there. Otherwise no action is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-size-constraint.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="medium" data-status="passed" data-account="777788889999" data-region="us-east-1">
-            <td><code>777788889999</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-69</code></td>
-            <td class="col-domain">Prompt Input Validation Functions Present</td>
-            <td class="finding-details">Found 1 Lambda function(s) with input validation/sanitization naming patterns: aiml-security-aiml-security-mgmt-CleanupBucket.</td>
-            <td class="resolution-text">Review these functions to confirm they cover: special-character stripping, format validation, size limits, and injection-sequence detection.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>AG-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="777788889999" data-region="us-west-2">
             <td><code>777788889999</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AG-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div></section>
+        </tr></tbody></table></div></div>
+            </section>
+            <section id="bedrock" class="section">
+                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>Amazon Bedrock Findings</div>
+                <div class="card"><div class="card-body">
+                    
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">50</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">18</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">225</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">293</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="bedrock" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="bedrock" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div>
+            </section>
+            <section id="sagemaker" class="section">
+                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span>Amazon SageMaker Findings</div>
+                <div class="card"><div class="card-body">
+                    
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">34</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">37</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">190</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">261</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="sagemaker" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="sagemaker" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div>
+            </section>
+            <section id="agentcore" class="section">
+                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span>Amazon Bedrock AgentCore Findings</div>
+                <div class="card"><div class="card-body">
+                    
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">39</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">3</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">80</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">122</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="agentcore" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="agentcore" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div>
+            </section>
+            <section id="agentic" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span>Agentic AI Security Findings</div><div class="card"><div class="card-body">
+                    <p class="finding-details" style="margin-bottom: 16px;">Scope: API-provable Agentic AI security controls mapped to the AWS Well-Architected Agentic AI Lens security guidance. Human-in-the-loop governance is referenced in methodology but not scored automatically unless an AWS API can prove the control.</p>
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">47</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">18</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">179</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">244</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="agentic" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="agentic" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div></section>
+            <section id="finserv" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span>Financial Services GenAI Risk Findings</div><div class="card"><div class="card-body">
+                    <p class="finding-details" style="margin-bottom: 16px;">Scope: this assessment records findings against each resolved CloudFormation TargetRegions entry. These checks are based on <a href="https://aws.amazon.com/blogs/security/introducing-the-updated-aws-user-guide-to-governance-risk-and-compliance-for-responsible-ai-adoption/" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>. Severities follow a documented Likelihood &times; Impact methodology.</p>
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">90</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">40</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">74</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">204</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="finserv" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="finserv" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div></section>
             <section id="methodology" class="section">
                 <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>Assessment Methodology</div>
-                <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Severity Levels &amp; Status Values</h3></div><div class="card-body" style="padding: 12px 16px;"><table style="width: 100%; font-size: 12px;"><tbody><tr><td style="padding: 4px 12px 4px 0; width: 100px;"><span class="severity high">High</span></td><td style="padding: 4px 0; color: var(--text-2); width: 45%;">Direct security risk</td><td style="padding: 4px 12px 4px 24px; width: 60px;"><span class="status error">Failed</span></td><td style="padding: 4px 0; color: var(--text-2);">Remediation needed</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity medium">Medium</span></td><td style="padding: 4px 0; color: var(--text-2);">Defense-in-depth gap</td><td style="padding: 4px 12px 4px 24px;"><span class="status success">Passed</span></td><td style="padding: 4px 0; color: var(--text-2);">Meets requirements</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity low">Low</span></td><td style="padding: 4px 0; color: var(--text-2);">Best practice</td><td style="padding: 4px 12px 4px 24px;"><span class="status warning">N/A</span></td><td style="padding: 4px 0; color: var(--text-2);">Not applicable</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity na">Informational</span></td><td style="padding: 4px 0; color: var(--text-2);">No action required</td><td></td><td></td></tr></tbody></table></div></div>
-                <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Remediation Guidance</h3></div><div class="card-body" style="padding: 12px 16px;"><table style="width: 100%; font-size: 12px;"><tbody><tr><td style="padding: 4px 12px 4px 0; width: 80px;"><span class="severity high">High</span></td><td style="padding: 4px 0; color: var(--text-2); width: 60px;">7 days</td><td style="padding: 4px 0; color: var(--text-2);">Address immediately; block deployment if unresolved</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity medium">Medium</span></td><td style="padding: 4px 0; color: var(--text-2);">30 days</td><td style="padding: 4px 0; color: var(--text-2);">Schedule in next sprint; may require change window</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity low">Low</span></td><td style="padding: 4px 0; color: var(--text-2);">90 days</td><td style="padding: 4px 0; color: var(--text-2);">Include in backlog; address during regular maintenance</td></tr></tbody></table></div></div>
                 <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Assessment Notes</h3></div><div class="card-body" style="padding: 12px 16px; font-size: 12px; color: var(--text-2); line-height: 1.6;"><strong style="color: var(--text);">Point-in-time:</strong> Security posture changes as resources are modified. <strong style="color: var(--text);">Scope limited:</strong> Passed checks verify tested controls only. <strong style="color: var(--text);">Context matters:</strong> Adjust severity for compliance requirements and environment type.</div></div>
                 <div class="card"><div class="card-header"><h3>Assessment Scope</h3></div><div class="card-body"><div style="display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 12px;"><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon Bedrock</span></div><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon SageMaker</span></div><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon Bedrock AgentCore</span></div></div><div class="scope-industry" data-scope-service="agentic"><div class="scope-industry-label">Agentic AI Security</div><div class="scope-chip-row"><div class="scope-chip industry-chip"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Agentic AI Security Lens Mapping</span></div></div></div><div class="scope-industry" data-scope-service="finserv"><div class="scope-industry-label">Industry</div><div class="scope-chip-row"><div class="scope-chip industry-chip"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Financial Services GenAI Risk</span></div></div></div><p style="color: var(--text-3); font-size: 12px;">Bedrock, SageMaker, and AgentCore checks are based on the <a href="https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/generative-ai-lens.html" target="_blank">AWS Well-Architected Framework Generative AI Lens</a>. Agentic AI Security references the <a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank">AWS Well-Architected Agentic AI Lens</a>. Controls that cannot be proven using AWS APIs, including semantic human-in-the-loop workflow quality, are not automatically scored. Financial Services GenAI Risk checks are based on <a href="https://aws.amazon.com/blogs/security/introducing-the-updated-aws-user-guide-to-governance-risk-and-compliance-for-responsible-ai-adoption/" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>.</p></div></div>
             </section>
@@ -38142,7 +21221,7 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             if (document.getElementById('regionFilter')) document.getElementById('regionFilter').value = '';
             document.getElementById('serviceFilter').value = '';
             document.getElementById('severityFilter').value = '';
-            document.getElementById('statusFilter').value = '';
+            document.getElementById('statusFilter').value = 'failed';
             applyFilters();
         });
         document.getElementById('searchInput').addEventListener('input', applyFilters);
@@ -38151,6 +21230,18 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
         document.getElementById('serviceFilter').addEventListener('change', applyFilters);
         document.getElementById('severityFilter').addEventListener('change', applyFilters);
         document.getElementById('statusFilter').addEventListener('change', applyFilters);
+        function filterFindings(service, status = 'failed') {
+            document.getElementById('serviceFilter').value = service || '';
+            document.getElementById('statusFilter').value = status;
+            applyFilters();
+            document.getElementById('findings').scrollIntoView({ behavior: 'smooth' });
+        }
+        document.querySelectorAll('[data-filter-service]').forEach(button => {
+            button.addEventListener('click', function() {
+                const status = this.hasAttribute('data-filter-status') ? this.dataset.filterStatus : 'failed';
+                filterFindings(this.dataset.filterService, status);
+            });
+        });
         window.addEventListener('scroll', () => {
             const sections = document.querySelectorAll('.section');
             let current = '';
@@ -38216,58 +21307,6 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
                 rows.forEach(row => tbody.appendChild(row));
             });
         });
-        // Service-specific filter functions
-        function createServiceFilter(tableId, searchId, accountId, regionId, severityId, statusId, resetId) {
-            const table = document.getElementById(tableId);
-            if (!table) return;
-            const searchInput = document.getElementById(searchId);
-            const accountFilter = document.getElementById(accountId);
-            const regionFilter = document.getElementById(regionId);
-            const severityFilter = document.getElementById(severityId);
-            const statusFilter = document.getElementById(statusId);
-            const resetBtn = document.getElementById(resetId);
-            function applyServiceFilters() {
-                const searchText = searchInput?.value.toLowerCase() || '';
-                const accountValue = accountFilter?.value.toLowerCase() || '';
-                const regionValue = regionFilter?.value.toLowerCase() || '';
-                const severityValue = severityFilter?.value.toLowerCase() || '';
-                const statusValue = statusFilter?.value.toLowerCase() || '';
-                const rows = table.querySelectorAll('tbody tr');
-                rows.forEach(row => {
-                    const rowText = row.textContent.toLowerCase();
-                    const rowAccount = row.dataset.account || '';
-                    const rowRegion = row.dataset.region || '';
-                    const rowSeverity = row.dataset.severity || '';
-                    const rowStatus = row.dataset.status || '';
-                    let show = true;
-                    if (searchText && !rowText.includes(searchText)) show = false;
-                    if (accountValue && rowAccount !== accountValue) show = false;
-                    if (regionValue && rowRegion.toLowerCase() !== regionValue) show = false;
-                    if (severityValue && rowSeverity !== severityValue) show = false;
-                    if (statusValue && rowStatus !== statusValue) show = false;
-                    row.style.display = show ? '' : 'none';
-                });
-            }
-            searchInput?.addEventListener('input', applyServiceFilters);
-            accountFilter?.addEventListener('change', applyServiceFilters);
-            regionFilter?.addEventListener('change', applyServiceFilters);
-            severityFilter?.addEventListener('change', applyServiceFilters);
-            statusFilter?.addEventListener('change', applyServiceFilters);
-            resetBtn?.addEventListener('click', function() {
-                if (searchInput) searchInput.value = '';
-                if (accountFilter) accountFilter.value = '';
-                if (regionFilter) regionFilter.value = '';
-                if (severityFilter) severityFilter.value = '';
-                if (statusFilter) statusFilter.value = '';
-                applyServiceFilters();
-            });
-        }
-        createServiceFilter('bedrockTable', 'bedrockSearchInput', 'bedrockAccountFilter', 'bedrockRegionFilter', 'bedrockSeverityFilter', 'bedrockStatusFilter', 'bedrockResetFilters');
-        createServiceFilter('sagemakerTable', 'sagemakerSearchInput', 'sagemakerAccountFilter', 'sagemakerRegionFilter', 'sagemakerSeverityFilter', 'sagemakerStatusFilter', 'sagemakerResetFilters');
-        createServiceFilter('agentcoreTable', 'agentcoreSearchInput', 'agentcoreAccountFilter', 'agentcoreRegionFilter', 'agentcoreSeverityFilter', 'agentcoreStatusFilter', 'agentcoreResetFilters');
-        createServiceFilter('agenticTable', 'agenticSearchInput', 'agenticAccountFilter', 'agenticRegionFilter', 'agenticSeverityFilter', 'agenticStatusFilter', 'agenticResetFilters');
-        createServiceFilter('finservTable', 'finservSearchInput', 'finservAccountFilter', 'finservRegionFilter', 'finservSeverityFilter', 'finservStatusFilter', 'finservResetFilters');
-
         // Apply initial filters for main table
         applyFilters();
     </script>
diff --git a/sample-reports/security_assessment_single_account.html b/sample-reports/security_assessment_single_account.html
index 054ae0b..a0785d7 100644
--- a/sample-reports/security_assessment_single_account.html
+++ b/sample-reports/security_assessment_single_account.html
@@ -114,15 +114,15 @@
         .alert-category { font-size: 12px; color: var(--text-2); margin-top: 2px; }
         .table-wrap { overflow-x: auto; max-height: 900px; overflow-y: auto; }
         table { width: 100%; border-collapse: collapse; font-size: 13px; table-layout: fixed; min-width: 1000px; }
-        table th:nth-child(1) { width: 10%; }
-        table th:nth-child(2) { width: 9%; }
-        table th:nth-child(3) { width: 6%; }
-        table th:nth-child(4) { width: 12%; }
-        table th:nth-child(5) { width: 18%; }
-        table th:nth-child(6) { width: 18%; }
-        table th:nth-child(7) { width: 6%; }
-        table th:nth-child(8) { width: 9%; }
-        table th:nth-child(9) { width: 9%; }
+        #findingsTable th:nth-child(1) { width: 13%; }
+        #findingsTable th:nth-child(2) { width: 11%; }
+        #findingsTable th:nth-child(3) { width: 8%; }
+        #findingsTable th:nth-child(4) { width: 46%; }
+        #findingsTable th:nth-child(5) { width: 11%; }
+        #findingsTable th:nth-child(6) { width: 11%; }
+        #findingsTable.single-account-report { min-width: 780px; }
+        #findingsTable.single-account-report th:nth-child(1),
+        #findingsTable.single-account-report td:nth-child(1) { display: none; }
         th { text-align: left; padding: 14px 16px; font-weight: 700; font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; color: var(--text); background: var(--surface-2); border-bottom: 3px solid var(--accent); white-space: nowrap; position: sticky; top: 0; }
         th.sortable { cursor: pointer; user-select: none; transition: background 0.15s; }
         th.sortable:hover { background: var(--border); }
@@ -160,6 +160,14 @@
         .reference-btn svg { width: 14px; height: 14px; }
         .finding-details { color: var(--text-2); font-size: 12px; line-height: 1.6; word-break: break-word; overflow-wrap: break-word; hyphens: auto; }
         .resolution-text { color: var(--text-2); font-size: 12px; line-height: 1.6; word-break: break-word; overflow-wrap: break-word; hyphens: auto; }
+        .finding-summary { text-align: left; }
+        .finding-more { margin-top: 8px; color: var(--text-2); font-size: 12px; }
+        .finding-more summary { cursor: pointer; color: var(--accent); font-weight: 600; }
+        .finding-more-body { display: grid; gap: 10px; margin-top: 10px; padding: 12px; background: var(--surface-2); border-radius: 6px; text-align: left; }
+        .finding-more-body strong { color: var(--text); font-size: 11px; text-transform: uppercase; letter-spacing: 0.3px; }
+        .finding-more-body p { margin-top: 2px; }
+        .assessment-summary-grid { display: grid; grid-template-columns: repeat(4, minmax(140px, 1fr)); gap: 16px; margin-bottom: 16px; }
+        .assessment-actions { display: flex; flex-wrap: wrap; gap: 10px; }
         @media (max-width: 1024px) { .layout { grid-template-columns: 1fr; } .sidebar { display: none; } .metrics { grid-template-columns: repeat(2, 1fr); } }
         @media (max-width: 640px) { .metrics { grid-template-columns: 1fr; } .main { padding: 20px; } }
         .page-footer { padding: 16px 40px; border-top: 1px solid var(--border); font-size: 10px; line-height: 1.6; color: var(--text-3); text-align: center; background: var(--surface); }
@@ -187,7 +195,7 @@ <h3>Navigation</h3>
                 <a href="#findings" class="nav-item">
                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
                     Security Findings
-                    <span class="count">462</span>
+                    <span class="count">282</span>
                 </a>
                 <a href="#risk" class="nav-item">
                     <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>
@@ -203,23 +211,23 @@ <h3>By Service</h3>
                 <a href="#bedrock" class="nav-item">
                     <span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>
                     Bedrock
-                    <span class="count">145</span>
+                    <span class="count">89</span>
                 </a>
                 <a href="#sagemaker" class="nav-item">
                     <span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span>
                     SageMaker
-                    <span class="count">136</span>
+                    <span class="count">82</span>
                 </a>
                 <a href="#agentcore" class="nav-item">
                     <span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span>
 	                    AgentCore
-	                    <span class="count">53</span>
+	                    <span class="count">33</span>
 	                </a>
 	            </nav>
-	            <nav class="nav-section lens-nav"><h3>By Lens</h3><a href="#agentic" class="nav-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security<span class="count">123</span></a></nav>
-	            <nav class="nav-section industry-nav"><h3>By Industry</h3><a href="#finserv" class="nav-item industry-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services<span class="count">5</span></a></nav>
+	            <nav class="nav-section lens-nav"><h3>By Lens</h3><a href="#agentic" class="nav-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security<span class="count">75</span></a></nav>
+	            <nav class="nav-section industry-nav"><h3>By Industry</h3><a href="#finserv" class="nav-item industry-item"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services<span class="count">3</span></a></nav>
 	            <div class="sidebar-footer">
-	                <p>Generated: July 09, 2026</p>
+	                <p>Generated: July 10, 2026</p>
 	                <p>Account: 123456789012</p>
                 <p style="margin-top: 8px;"><a href="https://github.com/aws-samples/sample-aiml-security-assessment">GitHub Repository</a></p>
             </div>
@@ -229,17 +237,17 @@ <h3>By Service</h3>
                 <div class="page-header">
                     <h2>Security Assessment Overview</h2>
                     <div class="page-header-meta">
-                        <span><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="4" width="18" height="18" rx="2" ry="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg>2026-07-09T22:25:20.613376</span>
-                        <span><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>Account: 123456789012 · 5 Regions</span>
+                        <span><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="4" width="18" height="18" rx="2" ry="2"/><line x1="16" y1="2" x2="16" y2="6"/><line x1="8" y1="2" x2="8" y2="6"/><line x1="3" y1="10" x2="21" y2="10"/></svg>2026-07-10T03:11:31.593820</span>
+                        <span><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>Account: 123456789012 · 3 Regions</span>
                     </div>
                 </div>
                 <div class="metrics">
-                    <div class="metric"><div class="metric-label">Security Checks</div><div class="metric-value">97</div><div class="metric-sub">Evaluated across 5 regions</div></div>
-                    <div class="metric"><div class="metric-label">Total Findings</div><div class="metric-value">462</div><div class="metric-sub">Across 5 regions</div></div>
-                    <div class="metric danger"><div class="metric-label">Actionable Findings</div><div class="metric-value">100</div><div class="metric-sub">High, Medium, and Low severity</div></div>
-                    <div class="metric danger"><div class="metric-label">High Severity</div><div class="metric-value">4/41</div><div class="metric-sub">9.8% passed · Immediate action required</div></div>
-                    <div class="metric warning"><div class="metric-label">Medium Severity</div><div class="metric-value">15/41</div><div class="metric-sub">36.6% passed · Should be addressed</div></div>
-                    <div class="metric highlight"><div class="metric-label">Low Severity</div><div class="metric-value">5/18</div><div class="metric-sub">27.8% passed · Best practices</div></div>
+                    <div class="metric"><div class="metric-label">Security Checks</div><div class="metric-value">97</div><div class="metric-sub">Evaluated across 3 regions</div></div>
+                    <div class="metric"><div class="metric-label">Total Findings</div><div class="metric-value">282</div><div class="metric-sub">Across 3 regions</div></div>
+                    <div class="metric danger"><div class="metric-label">Actionable Findings</div><div class="metric-value">6</div><div class="metric-sub">Failed High, Medium, and Low findings</div></div>
+                    <div class="metric danger"><div class="metric-label">High Severity</div><div class="metric-value">4/29</div><div class="metric-sub">13.8% passed · Immediate action required</div></div>
+                    <div class="metric warning"><div class="metric-label">Medium Severity</div><div class="metric-value">9/25</div><div class="metric-sub">36.0% passed · Should be addressed</div></div>
+                    <div class="metric highlight"><div class="metric-label">Low Severity</div><div class="metric-value">3/10</div><div class="metric-sub">30.0% passed · Best practices</div></div>
                 </div>
                 <div class="card"><div class="card-header"><h3>Priority Recommendations</h3></div><div class="card-body"><div class="alerts"><div class="alert-item critical">
             <div class="alert-count">3</div>
@@ -275,9714 +283,4026 @@ <h2>Security Assessment Overview</h2>
                     </div>
                 </div>
             </section>
+            <section id="risk" class="section">
+                <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>Risk Distribution</div>
+                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Pass Rate by Severity</h4>
+                <div class="metrics" style="margin-bottom: 32px;">
+                    <div class="metric danger"><div class="metric-label"><span class="severity high" style="padding: 2px 6px; font-size: 10px;">HIGH</span></div><div class="metric-value">13.8%</div><div class="metric-sub">4 of 29 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 13.8%; height: 100%; background: var(--danger);"></div></div></div>
+                    <div class="metric warning"><div class="metric-label"><span class="severity medium" style="padding: 2px 6px; font-size: 10px;">MEDIUM</span></div><div class="metric-value">36.0%</div><div class="metric-sub">9 of 25 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 36.0%; height: 100%; background: var(--warning);"></div></div></div>
+                    <div class="metric" style="border-color: var(--accent);"><div class="metric-label"><span class="severity low" style="padding: 2px 6px; font-size: 10px;">LOW</span></div><div class="metric-value" style="color: var(--accent);">30.0%</div><div class="metric-sub">3 of 10 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 30.0%; height: 100%; background: var(--accent);"></div></div></div>
+                    <div class="metric"><div class="metric-label">Overall</div><div class="metric-value">25.0%</div><div class="metric-sub">16 of 64 scored checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 25.0%; height: 100%; background: var(--text-3);"></div></div></div>
+                </div>
+                
+                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Region / Scope</h4>
+                <div class="metrics" style="margin-bottom: 32px;"><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">eu-west-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-east-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-west-2</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric danger" style="border-left: 3px solid var(--danger);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">Global</div><div class="metric-value">6</div><div class="metric-sub"><span style="color: var(--danger);">5 High</span> · <span style="color: var(--warning);">1 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div></div>
+                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Findings by Assessment Area</h4>
+                <div class="metrics">
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span> Bedrock</div><div class="metric-value">89</div><div class="metric-sub">4 Failed · 1 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span> SageMaker</div><div class="metric-value">82</div><div class="metric-sub">0 Failed · 13 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span> AgentCore</div><div class="metric-value">33</div><div class="metric-sub">1 Failed · 1 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security</div><div class="metric-value">75</div><div class="metric-sub">1 Failed &middot; 1 Passed</div></div>
+                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services Risk</div><div class="metric-value">3</div><div class="metric-sub">0 Failed · 0 Passed</div></div>
+                </div>
+            </section>
             <section id="findings" class="section">
                 <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>All Security Findings</div>
                 <div class="filter-bar">
                     <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="searchInput"></div>
                     
-                    <div class="filter-group"><label for="regionFilter">Region</label><select id="regionFilter" onchange="applyFilters()"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
+                    <div class="filter-group"><label for="regionFilter">Region</label><select id="regionFilter" onchange="applyFilters()"><option value="">All Regions</option><option value="eu-west-1">eu-west-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
                     <div class="filter-group"><label>Assessment Area</label><select id="serviceFilter"><option value="">All Assessment Areas</option><option value="bedrock">Bedrock</option><option value="sagemaker">SageMaker</option><option value="agentcore">AgentCore</option><option value="agentic">Agentic AI Security</option><option value="finserv">Financial Services</option></select></div>
                     <div class="filter-group"><label>Severity</label><select id="severityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="statusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
+                    <div class="filter-group"><label>Status</label><select id="statusFilter"><option value="">All Statuses</option><option value="failed" selected>Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
                     <button class="btn btn-reset" id="resetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
                 </div>
-                <div class="card"><div class="table-wrap"><table id="findingsTable"><thead><tr><th class="sortable" data-sort="account">Account ID</th><th class="sortable" data-sort="region">Region</th><th class="sortable" data-sort="checkId">Check ID</th><th class="sortable" data-sort="finding">Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th class="sortable" data-sort="severity">Severity</th><th class="sortable" data-sort="status">Status</th></tr></thead><tbody><tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+                <div class="card"><div class="table-wrap"><table id="findingsTable" class="single-account-report"><thead><tr><th class="sortable" data-sort="account">Account ID</th><th class="sortable" data-sort="region">Region</th><th class="sortable" data-sort="checkId">Check ID</th><th class="sortable" data-sort="finding">Finding</th><th class="sortable" data-sort="severity">Severity</th><th class="sortable" data-sort="status">Status</th></tr></thead><tbody><tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
 1. Create and version your prompts
 2. Test different prompt variants
 3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</p></div>
+                        <div><strong>Resolution</strong><p>Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
+            <td><code>eu-west-1</code></td>
             <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AmazonBedrockFullAccess role check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No roles found with AmazonBedrockFullAccess policy</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
+https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
+            <td><code>123456789012</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'aws-elasticbeanstalk-ec2-role' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkMulticontainerDocker'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
+            <td><code>123456789012</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'RescoAppStack-Ec2Role2FD9A272-UB7xzDXt03Lg' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
+            <td><code>123456789012</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Marketplace Subscription Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Role 'xray-sample-SampleInstanceProfileRole-1WB21O2X8T7ZV' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'</p></div>
+                        <div><strong>Resolution</strong><p>Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+            <td><code>123456789012</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
 1. Create and version your prompts
 2. Test different prompt variants
 3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>Global</code></td>
+            <td><code>BR-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Cross-Account Guardrails Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Bedrock Guardrails policy type is not enabled at the organization level. Cross-account guardrails cannot be enforced without enabling this policy type.</p></div>
+                        <div><strong>Resolution</strong><p>Enable Bedrock Guardrails policy type in AWS Organizations to enforce consistent safety controls across all accounts. Use AWS Organizations console or CLI to enable the policy type.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+            <td><code>123456789012</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>Global</code></td>
+            <td><code>AG-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Guardrail Enforcement Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Bedrock Guardrails policy type is not enabled at the organization level. Cross-account guardrails cannot be enforced without enabling this policy type.</p></div>
+                        <div><strong>Resolution</strong><p>Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+            <td><code>123456789012</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
+            <td><code>us-east-1</code></td>
             <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Amazon Bedrock private connectivity check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess private connectivity</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Model Invocation Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to protect with guardrails</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudTrail Logging Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Prompt Management Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Prompt Management to:
 1. Create and version your prompts
 2. Test different prompt variants
 3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+4. Maintain consistent prompt templates</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Agent IAM Roles Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Knowledge Base Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Knowledge Bases found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Guardrail IAM Enforcement Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No guardrails configured - IAM enforcement check not applicable</p></div>
+                        <div><strong>Resolution</strong><p>Configure Bedrock Guardrails first, then enforce their use via IAM policies</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Custom Model Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom/fine-tuned models found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Invocation Log Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model invocation logging to S3 is not configured</p></div>
+                        <div><strong>Resolution</strong><p>If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock Flows Guardrails Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock Flows found in the account</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Tier Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Custom Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No custom (fine-tuned) Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Evaluation Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Prompt Flow Validation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Action Group IAM Least Privilege Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Invocation Throttling Limits Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Content Filter Coverage Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Automated Reasoning Policy Implementation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with Automated Reasoning policies for formal verification of model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">RAG Evaluation Jobs Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock knowledge bases found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Sensitive Information Filter Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Guardrail Contextual Grounding Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Guardrail Association Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agent Idle Session TTL Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity low">Low</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
+            <td class="finding-summary">
+                <div class="col-domain">Imported Model Customer-Managed KMS Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No imported custom Bedrock models found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Batch Inference Output Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Bedrock batch inference (model invocation) jobs found in this region</p></div>
+                        <div><strong>Resolution</strong><p>When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Bedrock CloudWatch Alarm Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Model Invocation Logging</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</p></div>
+                        <div><strong>Resolution</strong><p>Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI API Audit Trail</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Adversarial Evaluation Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</p></div>
+                        <div><strong>Resolution</strong><p>Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Prompt Flow Validation</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Tool Execution Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Invocation Abuse Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</p></div>
+                        <div><strong>Resolution</strong><p>Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Harmful Content Guardrail Coverage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Automated Reasoning Guardrails</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure automated reasoning policies on guardrails where formal response validation is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Sensitive Information Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Grounding Controls</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Agent Guardrail Association</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Session Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</p></div>
+                        <div><strong>Resolution</strong><p>Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
+            <td><code>us-west-2</code></td>
             <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Operational Abuse Alarms</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</p></div>
+                        <div><strong>Resolution</strong><p>Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">No roles found with AmazonBedrockFullAccess policy</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'aws-elasticbeanstalk-ec2-role' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkMulticontainerDocker'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'RescoAppStack-Ec2Role2FD9A272-UB7xzDXt03Lg' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'xray-sample-SampleInstanceProfileRole-1WB21O2X8T7ZV' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Bedrock Guardrails policy type is not enabled at the organization level. Cross-account guardrails cannot be enforced without enabling this policy type.</td>
-            <td class="resolution-text">Enable Bedrock Guardrails policy type in AWS Organizations to enforce consistent safety controls across all accounts. Use AWS Organizations console or CLI to enable the policy type.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Bedrock Guardrails policy type is not enabled at the organization level. Cross-account guardrails cannot be enforced without enabling this policy type.</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker IAM Permissions Check</td>
-            <td class="finding-details">No issues found with IAM permissions and no stale access detected</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Full Access Check</td>
-            <td class="finding-details">No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="risk" class="section">
-                <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="22 12 18 12 15 21 9 3 6 12 2 12"/></svg>Risk Distribution</div>
-                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Pass Rate by Severity</h4>
-                <div class="metrics" style="margin-bottom: 32px;">
-                    <div class="metric danger"><div class="metric-label"><span class="severity high" style="padding: 2px 6px; font-size: 10px;">HIGH</span></div><div class="metric-value">9.8%</div><div class="metric-sub">4 of 41 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 9.8%; height: 100%; background: var(--danger);"></div></div></div>
-                    <div class="metric warning"><div class="metric-label"><span class="severity medium" style="padding: 2px 6px; font-size: 10px;">MEDIUM</span></div><div class="metric-value">36.6%</div><div class="metric-sub">15 of 41 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 36.6%; height: 100%; background: var(--warning);"></div></div></div>
-                    <div class="metric" style="border-color: var(--accent);"><div class="metric-label"><span class="severity low" style="padding: 2px 6px; font-size: 10px;">LOW</span></div><div class="metric-value" style="color: var(--accent);">27.8%</div><div class="metric-sub">5 of 18 checks passed</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 27.8%; height: 100%; background: var(--accent);"></div></div></div>
-                    <div class="metric"><div class="metric-label">Overall</div><div class="metric-value">24.0%</div><div class="metric-sub">24 of 100 actionable checks</div><div style="margin-top: 8px; height: 4px; background: var(--surface-2); border-radius: 2px; overflow: hidden;"><div style="width: 24.0%; height: 100%; background: var(--text-3);"></div></div></div>
-                </div>
-                
-                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Risk by Region</h4>
-                <div class="metrics" style="margin-bottom: 32px;"><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">ap-south-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">eu-west-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">sa-east-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-east-1</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div><div class="metric " style="border-left: 3px solid var(--success);"><div class="metric-label" style="font-family: 'JetBrains Mono', monospace; font-size: 12px;">us-west-2</div><div class="metric-value">0</div><div class="metric-sub"><span style="color: var(--danger);">0 High</span> · <span style="color: var(--warning);">0 Med</span> · <span style="color: var(--accent);">0 Low</span></div></div></div>
-                <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px;">Findings by Assessment Area</h4>
-                <div class="metrics">
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span> Bedrock</div><div class="metric-value">145</div><div class="metric-sub">4 Failed · 1 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span> SageMaker</div><div class="metric-value">136</div><div class="metric-sub">0 Failed · 21 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span> AgentCore</div><div class="metric-value">53</div><div class="metric-sub">1 Failed · 1 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span> Agentic AI Security</div><div class="metric-value">123</div><div class="metric-sub">1 Failed &middot; 1 Passed</div></div>
-                    <div class="metric"><div class="metric-label"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span> Financial Services Risk</div><div class="metric-value">5</div><div class="metric-sub">0 Failed · 0 Passed</div></div>
-                </div>
-            </section>
-            <section id="bedrock" class="section">
-                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>Amazon Bedrock Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="bedrockSearchInput"></div>
-                    
-                    <div class="filter-group"><label for="bedrockRegionFilter">Region</label><select id="bedrockRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
-                    <div class="filter-group"><label>Severity</label><select id="bedrockSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="bedrockStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="bedrockResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="bedrockTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">Unable to check Imported model encryption check: An error occurred (AccessDeniedException) when calling the ListImportedModels operation: Your account is not authorized to invoke this API operation.</td>
-            <td class="resolution-text">Amazon Bedrock Custom Model Import is not enabled or available for this account in this region. No IAM change is required; the check applies only once model import is in use.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-01</code></td>
-            <td class="col-domain">AmazonBedrockFullAccess role check</td>
-            <td class="finding-details">No roles found with AmazonBedrockFullAccess policy</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-agent.html#iam-agents-ex-all
-https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_id-based-policy-examples-br-studio.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'aws-elasticbeanstalk-ec2-role' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkMulticontainerDocker'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'RescoAppStack-Ec2Role2FD9A272-UB7xzDXt03Lg' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-03</code></td>
-            <td class="col-domain">Marketplace Subscription Access Check</td>
-            <td class="finding-details">Role 'xray-sample-SampleInstanceProfileRole-1WB21O2X8T7ZV' has overly permissive marketplace subscription access through policy 'AWSElasticBeanstalkWebTier'</td>
-            <td class="resolution-text">Ensure that users have access to only the models that you want user to be able to subscribe to based on your organizational policies. For example, you may want users to have access to only text based models and not image and video generation model. This can also help to keep cost in check.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-bedrock-marketplace" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>BR-15</code></td>
-            <td class="col-domain">Cross-Account Guardrails Enforcement Check</td>
-            <td class="finding-details">Bedrock Guardrails policy type is not enabled at the organization level. Cross-account guardrails cannot be enforced without enabling this policy type.</td>
-            <td class="resolution-text">Enable Bedrock Guardrails policy type in AWS Organizations to enforce consistent safety controls across all accounts. Use AWS Organizations console or CLI to enable the policy type.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_bedrock.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-02</code></td>
-            <td class="col-domain">Amazon Bedrock private connectivity check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess private connectivity</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-interface-endpoints.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-04</code></td>
-            <td class="col-domain">Bedrock Model Invocation Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-05</code></td>
-            <td class="col-domain">Bedrock Guardrails Check</td>
-            <td class="finding-details">No regional Bedrock resources found to protect with guardrails</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-06</code></td>
-            <td class="col-domain">Bedrock CloudTrail Logging Check</td>
-            <td class="finding-details">No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-07</code></td>
-            <td class="col-domain">Bedrock Prompt Management Check</td>
-            <td class="finding-details">Prompt Management feature is not being used. This may lead to inconsistent prompt handling and suboptimal model responses.</td>
-            <td class="resolution-text">Implement Prompt Management to:
-1. Create and version your prompts
-2. Test different prompt variants
-3. Share prompts across your organization
-4. Maintain consistent prompt templates</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-08</code></td>
-            <td class="col-domain">Bedrock Agent IAM Roles Check</td>
-            <td class="finding-details">No Bedrock agents found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-09</code></td>
-            <td class="col-domain">Bedrock Knowledge Base Encryption Check</td>
-            <td class="finding-details">No Knowledge Bases found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-10</code></td>
-            <td class="col-domain">Bedrock Guardrail IAM Enforcement Check</td>
-            <td class="finding-details">No guardrails configured - IAM enforcement check not applicable</td>
-            <td class="resolution-text">Configure Bedrock Guardrails first, then enforce their use via IAM policies</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-11</code></td>
-            <td class="col-domain">Bedrock Custom Model Encryption Check</td>
-            <td class="finding-details">No custom/fine-tuned models found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-12</code></td>
-            <td class="col-domain">Bedrock Invocation Log Encryption Check</td>
-            <td class="finding-details">Model invocation logging to S3 is not configured</td>
-            <td class="resolution-text">If logging is enabled to CloudWatch only, ensure CloudWatch log group uses CMK encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-13</code></td>
-            <td class="col-domain">Bedrock Flows Guardrails Check</td>
-            <td class="finding-details">No Bedrock Flows found in the account</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-16</code></td>
-            <td class="col-domain">Guardrail Tier Validation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create Bedrock guardrails with Standard tier for enhanced content filtering and protection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-components.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-17</code></td>
-            <td class="col-domain">Custom Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No custom (fine-tuned) Bedrock models found in this region</td>
-            <td class="resolution-text">When creating custom models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-18</code></td>
-            <td class="col-domain">Model Evaluation Implementation Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/evaluation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-19</code></td>
-            <td class="col-domain">Prompt Flow Validation Check</td>
-            <td class="finding-details">No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">When creating prompt flows, use the ValidateFlowDefinition API to validate flow definitions before deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/flows.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-20</code></td>
-            <td class="col-domain">Knowledge Base Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When creating knowledge bases, specify customer-managed KMS keys for both vector store and data source encryption</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-kb.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-21</code></td>
-            <td class="col-domain">Agent Action Group IAM Least Privilege Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents with action groups, ensure Lambda execution roles follow least privilege principles</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-22</code></td>
-            <td class="col-domain">Model Invocation Throttling Limits Check</td>
-            <td class="finding-details">No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-23</code></td>
-            <td class="col-domain">Guardrail Content Filter Coverage Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with all content filters enabled (hate, insults, sexual, violence) with appropriate thresholds</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-24</code></td>
-            <td class="col-domain">Automated Reasoning Policy Implementation Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with Automated Reasoning policies for formal verification of model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-automated-reasoning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-25</code></td>
-            <td class="col-domain">RAG Evaluation Jobs Check</td>
-            <td class="finding-details">No Bedrock knowledge bases found in this region</td>
-            <td class="resolution-text">When implementing RAG applications, configure evaluation jobs to assess context relevance, response correctness, and prevent hallucinations</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-evaluation-rag.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-26</code></td>
-            <td class="col-domain">Guardrail Sensitive Information Filter Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with sensitive-information filters (PII entities and/or regex patterns) to detect and redact sensitive data in prompts and model responses</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-27</code></td>
-            <td class="col-domain">Guardrail Contextual Grounding Check</td>
-            <td class="finding-details">No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Create guardrails with contextual grounding checks to detect hallucinations (ungrounded responses) and irrelevant answers, especially for RAG applications</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-contextual-grounding-check.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-28</code></td>
-            <td class="col-domain">Agent Guardrail Association Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, associate a Bedrock guardrail so agent inputs and responses are filtered for harmful content, PII, and denied topics</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="low" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-29</code></td>
-            <td class="col-domain">Agent Idle Session TTL Check</td>
-            <td class="finding-details">No Bedrock agents configured in this region</td>
-            <td class="resolution-text">When creating agents, set a conservative idleSessionTTLInSeconds to limit how long an idle session remains resumable</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/agents-create.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="high" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-30</code></td>
-            <td class="col-domain">Imported Model Customer-Managed KMS Encryption Check</td>
-            <td class="finding-details">No imported custom Bedrock models found in this region</td>
-            <td class="resolution-text">When importing models, specify a customer-managed KMS key for encryption to maintain control over encryption keys</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-import-model.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="medium" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-31</code></td>
-            <td class="col-domain">Batch Inference Output Encryption Check</td>
-            <td class="finding-details">No Bedrock batch inference (model invocation) jobs found in this region</td>
-            <td class="resolution-text">When creating batch inference jobs, set outputDataConfig.s3OutputDataConfig.s3EncryptionKeyId to a customer-managed KMS key to encrypt the job output</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="bedrock" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>BR-32</code></td>
-            <td class="col-domain">Bedrock CloudWatch Alarm Check</td>
-            <td class="finding-details">No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="sagemaker" class="section">
-                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span>Amazon SageMaker Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="sagemakerSearchInput"></div>
-                    
-                    <div class="filter-group"><label for="sagemakerRegionFilter">Region</label><select id="sagemakerRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
-                    <div class="filter-group"><label>Severity</label><select id="sagemakerSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="sagemakerStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="sagemakerResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="sagemakerTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker IAM Permissions Check</td>
-            <td class="finding-details">No issues found with IAM permissions and no stale access detected</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-01</code></td>
-            <td class="col-domain">SageMaker Internet Access Check</td>
-            <td class="finding-details">No SageMaker notebook instances or domains found to check</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-02</code></td>
-            <td class="col-domain">SageMaker SSO Configuration Check</td>
-            <td class="finding-details">No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-03</code></td>
-            <td class="col-domain">Data Protection Check</td>
-            <td class="finding-details">No SageMaker resources found to check for data protection</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-04</code></td>
-            <td class="col-domain">GuardDuty Enabled</td>
-            <td class="finding-details">Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Model Registry Issue</td>
-            <td class="finding-details">No model package groups found</td>
-            <td class="resolution-text">Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Feature Store Issue</td>
-            <td class="finding-details">No feature groups found</td>
-            <td class="resolution-text">Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-05</code></td>
-            <td class="col-domain">SageMaker Pipelines Issue</td>
-            <td class="finding-details">No ML pipelines found</td>
-            <td class="resolution-text">Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-06</code></td>
-            <td class="col-domain">SageMaker Clarify No Clarify Usage</td>
-            <td class="finding-details">No SageMaker Clarify jobs found</td>
-            <td class="resolution-text">Implement SageMaker Clarify for model explainability and bias detection</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-07</code></td>
-            <td class="col-domain">SageMaker Model Monitor No Model Monitoring</td>
-            <td class="finding-details">No Model Monitor schedules found</td>
-            <td class="resolution-text">Configure comprehensive model monitoring schedules</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-08</code></td>
-            <td class="col-domain">Model Registry Registry Not Used</td>
-            <td class="finding-details">Model Registry is not being utilized</td>
-            <td class="resolution-text">Implement proper model versioning and approval workflows</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-09</code></td>
-            <td class="col-domain">SageMaker Notebook Root Access Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-10</code></td>
-            <td class="col-domain">SageMaker Notebook VPC Deployment Check</td>
-            <td class="finding-details">No notebook instances found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-11</code></td>
-            <td class="col-domain">SageMaker Model Network Isolation Check</td>
-            <td class="finding-details">No models found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-12</code></td>
-            <td class="col-domain">SageMaker Endpoint Instance Count Check</td>
-            <td class="finding-details">No InService endpoints found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-13</code></td>
-            <td class="col-domain">SageMaker Monitoring Network Isolation Check</td>
-            <td class="finding-details">No monitoring schedules found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-14</code></td>
-            <td class="col-domain">SageMaker Model Repository Access Check</td>
-            <td class="finding-details">No models found or all use default Platform access</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-15</code></td>
-            <td class="col-domain">SageMaker Feature Store Encryption Check</td>
-            <td class="finding-details">No feature groups with offline stores found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-16</code></td>
-            <td class="col-domain">SageMaker Data Quality Job Encryption Check</td>
-            <td class="finding-details">No data quality job definitions found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-17</code></td>
-            <td class="col-domain">SageMaker Processing Job Encryption Check</td>
-            <td class="finding-details">No processing jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-18</code></td>
-            <td class="col-domain">SageMaker Transform Job Encryption Check</td>
-            <td class="finding-details">No transform jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-19</code></td>
-            <td class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</td>
-            <td class="finding-details">No hyperparameter tuning jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-20</code></td>
-            <td class="col-domain">SageMaker Compilation Job Encryption Check</td>
-            <td class="finding-details">No compilation jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-21</code></td>
-            <td class="col-domain">SageMaker AutoML Job Network Isolation Check</td>
-            <td class="finding-details">No AutoML jobs found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-22</code></td>
-            <td class="col-domain">Model Approval Workflow Check</td>
-            <td class="finding-details">No model package groups found. Model Registry is not being used for model governance.</td>
-            <td class="resolution-text">Implement Model Registry to track model versions and enforce approval workflows before production deployment.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-23</code></td>
-            <td class="col-domain">Model Drift Detection Check</td>
-            <td class="finding-details">No InService endpoints found to monitor.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity medium">Medium</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-24</code></td>
-            <td class="col-domain">A/B Testing and Shadow Deployment Check</td>
-            <td class="finding-details">No InService endpoints found.</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity low">Low</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>SM-25</code></td>
-            <td class="col-domain">ML Lineage Tracking - Experiments Not Used</td>
-            <td class="finding-details">No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</td>
-            <td class="resolution-text">Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="agentcore" class="section">
-                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span>Amazon Bedrock AgentCore Findings</div>
-                <div class="filter-bar">
-                    <div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="agentcoreSearchInput"></div>
-                    
-                    <div class="filter-group"><label for="agentcoreRegionFilter">Region</label><select id="agentcoreRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option><option value="Global">Global</option></select></div>
-                    <div class="filter-group"><label>Severity</label><select id="agentcoreSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div>
-                    <div class="filter-group"><label>Status</label><select id="agentcoreStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div>
-                    <button class="btn btn-reset" id="agentcoreResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button>
-                </div>
-                <div class="card"><div class="table-wrap"><table id="agentcoreTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
-            <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-02</code></td>
-            <td class="col-domain">AgentCore IAM Full Access Check</td>
-            <td class="finding-details">No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status success">Passed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-03</code></td>
-            <td class="col-domain">AgentCore Unused Permissions</td>
-            <td class="finding-details">The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Review and remove unused AgentCore permissions following least privilege principle</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="123456789012" data-region="Global">
-            <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AC-09</code></td>
-            <td class="col-domain">AgentCore Service-Linked Role Missing</td>
-            <td class="finding-details">Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</td>
-            <td class="resolution-text">The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity medium">Medium</span></td>
-            <td><span class="status error">Failed</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-01</code></td>
-            <td class="col-domain">AgentCore VPC Configuration Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-04</code></td>
-            <td class="col-domain">AgentCore Observability Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-05</code></td>
-            <td class="col-domain">AgentCore Encryption Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
-            <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-06</code></td>
-            <td class="col-domain">AgentCore Browser Tool Recording Check</td>
-            <td class="finding-details">No AgentCore Runtimes found to check browser tool configuration</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-07</code></td>
-            <td class="col-domain">AgentCore Memory Configuration Check</td>
-            <td class="finding-details">No Memory resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-13</code></td>
-            <td class="col-domain">AgentCore Gateway Configuration Check</td>
-            <td class="finding-details">No Gateway resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-08</code></td>
-            <td class="col-domain">AgentCore VPC Endpoints Check</td>
-            <td class="finding-details">No AgentCore resources found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-10</code></td>
-            <td class="col-domain">AgentCore Resource-Based Policies Check</td>
-            <td class="finding-details">No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-11</code></td>
-            <td class="col-domain">AgentCore Policy Engine Encryption Check</td>
-            <td class="finding-details">No Policy Engines found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>us-west-2</code></td>
-            <td><code>AC-12</code></td>
-            <td class="col-domain">AgentCore Gateway Encryption Check</td>
-            <td class="finding-details">No Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div>
-            </section>
-            <section id="agentic" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span>Agentic AI Security Findings</div><div class="muted" style="margin:-6px 0 10px;font-size:13px;">Scope: API-provable Agentic AI security controls mapped to the AWS Well-Architected Agentic AI Lens security guidance. Human-in-the-loop governance is referenced in methodology but not scored automatically unless an AWS API can prove the control.</div><div class="filter-bar"><div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="agenticSearchInput"></div><div class="filter-group"><label>Region</label><select id="agenticRegionFilter"><option value="">All Regions</option><option value="Global">Global</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option></select></div><div class="filter-group"><label>Severity</label><select id="agenticSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div><div class="filter-group"><label>Status</label><select id="agenticStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div><button class="btn btn-reset" id="agenticResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button></div><div class="card"><div class="table-wrap"><table id="agenticTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker IAM Permissions Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No issues found with IAM permissions and no stale access detected</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+            <td><code>123456789012</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+            <td><code>123456789012</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+            <td><code>123456789012</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>eu-west-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="high" data-status="failed" data-account="123456789012" data-region="Global">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>Global</code></td>
-            <td><code>AG-09</code></td>
-            <td class="col-domain">Agentic AI Guardrail Enforcement Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Organization-level guardrail enforcement helps prevent agents from bypassing required safety controls across accounts. Source check BR-15: Bedrock Guardrails policy type is not enabled at the organization level. Cross-account guardrails cannot be enforced without enabling this policy type.</td>
-            <td class="resolution-text">Use IAM and organization controls to require approved guardrails for model and agent invocations where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity high">High</span></td>
-            <td><span class="status error">Failed</span></td>
+            <td><code>us-east-1</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Internet Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker notebook instances or domains found to check</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker SSO Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker domains found, or all domains use SSO with IAM Identity Center configured</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.amazon.com/blogs/machine-learning/team-and-user-management-with-amazon-sagemaker-and-aws-sso/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Data Protection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker resources found to check for data protection</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">GuardDuty Enabled</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Amazon GuardDuty is properly enabled and monitoring for security threats in SageMaker workloads.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/guardduty/latest/ug/ai-protection.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Registry Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found</p></div>
+                        <div><strong>Resolution</strong><p>Implement model versioning using SageMaker Model Registry to track model lineage, approve model versions, and manage model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups found</p></div>
+                        <div><strong>Resolution</strong><p>Utilize SageMaker Feature Store to create, share, and manage features for machine learning development and production</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Pipelines Issue</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No ML pipelines found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Pipelines to automate and manage ML workflows, including data preparation, training, and model deployment</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mlops.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Clarify No Clarify Usage</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Clarify jobs found</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Clarify for model explainability and bias detection</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Monitor No Model Monitoring</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Model Monitor schedules found</p></div>
+                        <div><strong>Resolution</strong><p>Configure comprehensive model monitoring schedules</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Registry Registry Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Model Registry is not being utilized</p></div>
+                        <div><strong>Resolution</strong><p>Implement proper model versioning and approval workflows</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>us-east-1</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook Root Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-root-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-07</code></td>
-            <td class="col-domain">Agentic AI Model Invocation Logging</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agents can take multi-step actions, so prompt, response, and guardrail traces need to be available for investigation. Source check BR-04: No regional Bedrock resources found to monitor with invocation logging</td>
-            <td class="resolution-text">Enable Amazon Bedrock model invocation logging and retain logs according to your incident response and data governance requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Notebook VPC Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No notebook instances found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-08</code></td>
-            <td class="col-domain">Agentic AI API Audit Trail</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. Agent activity must be attributable through CloudTrail events for Bedrock control plane and runtime operations. Source check BR-06: No regional Bedrock resources found to audit with Bedrock-specific CloudTrail coverage</td>
-            <td class="resolution-text">Enable CloudTrail trails with management event logging and validate that Bedrock API activity is captured.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-10</code></td>
-            <td class="col-domain">Agentic AI Adversarial Evaluation Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Agentic applications should be tested for adversarial prompts and unsafe behaviors before production use. Source check BR-18: No regional Bedrock resources found to assess with model evaluation jobs</td>
-            <td class="resolution-text">Configure model or application evaluations that include adversarial, safety, and security-relevant test cases.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Endpoint Instance Count Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/endpoint-auto-scaling.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-11</code></td>
-            <td class="col-domain">Agentic AI Prompt Flow Validation</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Validated prompt flows reduce the risk that malformed orchestration logic causes unsafe agent behavior. Source check BR-19: No Bedrock prompt flows configured in this region</td>
-            <td class="resolution-text">Validate Bedrock flow definitions before deployment and remediate validation findings before publishing new versions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Monitoring Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No monitoring schedules found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-network-isolation.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-06</code></td>
-            <td class="col-domain">Agentic AI Tool Execution Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Agent action groups are tool execution boundaries; over-permissive roles can let an agent perform unintended operations. Source check BR-21: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Restrict action group Lambda roles and referenced IAM permissions to the specific tools, resources, and actions required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-14</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Model Repository Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No models found or all use default Platform access</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-container-repositories.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-12</code></td>
-            <td class="col-domain">Agentic AI Invocation Abuse Controls</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. Autonomous agents can amplify token usage through retries, loops, or high-volume tool workflows. Source check BR-22: No regional Bedrock resources found to assess model invocation throttling quotas</td>
-            <td class="resolution-text">Configure service quotas, throttling limits, and alerting to detect and limit abnormal model invocation patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-15</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Feature Store Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No feature groups with offline stores found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-02</code></td>
-            <td class="col-domain">Agentic AI Harmful Content Guardrail Coverage</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Agents should use guardrails that filter harmful content in both intermediate and final responses. Source check BR-23: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrails with appropriate content filters and thresholds for all agent-facing workloads.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-16</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Data Quality Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No data quality job definitions found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-04</code></td>
-            <td class="col-domain">Agentic AI Automated Reasoning Guardrails</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Automated reasoning policies help verify agent responses against deterministic business or safety rules. Source check BR-24: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure automated reasoning policies on guardrails where formal response validation is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-17</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Processing Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No processing jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-03</code></td>
-            <td class="col-domain">Agentic AI Sensitive Information Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agents can receive and produce sensitive data across conversations, tool calls, and retrieved context. Source check BR-26: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Configure guardrail sensitive-information filters for PII entities and custom sensitive-data patterns.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-18</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Transform Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No transform jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/batch-transform.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-05</code></td>
-            <td class="col-domain">Agentic AI Grounding Controls</td>
-            <td class="finding-details">Agentic AI security domain: Prompt & Input Protection. Grounding checks reduce the chance that an agent acts on hallucinated or irrelevant context. Source check BR-27: No Bedrock guardrails configured in this region</td>
-            <td class="resolution-text">Enable contextual grounding checks on guardrails for RAG and tool-using agent workflows.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-19</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Hyperparameter Tuning Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No hyperparameter tuning jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-01</code></td>
-            <td class="col-domain">Agentic AI Agent Guardrail Association</td>
-            <td class="finding-details">Agentic AI security domain: Guardrail Enforcement. Bedrock agents should have guardrails associated so autonomous interactions are filtered consistently. Source check BR-28: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Associate an approved Bedrock guardrail with each Bedrock agent and prepare the agent after updating.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-20</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker Compilation Job Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No compilation jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/neo.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-13</code></td>
-            <td class="col-domain">Agentic AI Session Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Long-lived idle sessions widen the window for session reuse and unintended continuation of agent context. Source check BR-29: No Bedrock agents configured in this region</td>
-            <td class="resolution-text">Set a conservative idleSessionTTLInSeconds value for agents based on application session requirements.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-21</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">SageMaker AutoML Job Network Isolation Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AutoML jobs found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-security.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
-            <td><code>AG-14</code></td>
-            <td class="col-domain">Agentic AI Operational Abuse Alarms</td>
-            <td class="finding-details">Agentic AI security domain: Abuse & Cost Protection. CloudWatch alarms help detect anomalous invocation errors, throttling, or volume caused by autonomous workflows. Source check BR-32: No regional Bedrock resources found to monitor with CloudWatch alarms</td>
-            <td class="resolution-text">Configure CloudWatch alarms for Bedrock invocation errors, throttles, latency, and token or request volume where metrics are available.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>SM-22</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Approval Workflow Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No model package groups found. Model Registry is not being used for model governance.</p></div>
+                        <div><strong>Resolution</strong><p>Implement Model Registry to track model versions and enforce approval workflows before production deployment.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-approve.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="sagemaker" data-severity="medium" data-status="passed" data-account="123456789012" data-region="us-west-2">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-23</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">Model Drift Detection Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found to monitor.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="low" data-status="passed" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-24</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">A/B Testing and Shadow Deployment Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No InService endpoints found.</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/model-ab-testing.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity low">Low</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="sagemaker" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>SM-25</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">ML Lineage Tracking - Experiments Not Used</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No SageMaker Experiments found. ML Lineage tracking through Experiments is not being utilized.</p></div>
+                        <div><strong>Resolution</strong><p>Implement SageMaker Experiments to track ML training runs, hyperparameters, metrics, and model artifacts. This enables reproducibility and auditability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="eu-west-1">
             <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>eu-west-1</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -9990,10 +4310,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10001,10 +4328,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10012,10 +4346,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10023,10 +4364,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10034,10 +4382,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10045,10 +4400,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10056,10 +4418,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10067,10 +4436,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10078,10 +4454,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10089,10 +4472,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10100,131 +4490,251 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="high" data-status="passed" data-account="123456789012" data-region="Global">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>AC-02</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore IAM Full Access Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No roles with overly permissive AgentCore access found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity high">High</span></td>
+            <td><span class="status success">Passed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="Global">
+            <td><code>123456789012</code></td>
+            <td><code>Global</code></td>
+            <td><code>AC-03</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Unused Permissions</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</p></div>
+                        <div><strong>Resolution</strong><p>Review and remove unused AgentCore permissions following least privilege principle</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="medium" data-status="failed" data-account="123456789012" data-region="Global">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>Global</code></td>
+            <td><code>AC-09</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Service-Linked Role Missing</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Service-linked role 'AWSServiceRoleForBedrockAgentCoreNetwork' does not exist. VPC configuration for AgentCore Runtimes will fail without this role.</p></div>
+                        <div><strong>Resolution</strong><p>The service-linked role is automatically created when you configure VPC for an AgentCore Runtime. Ensure IAM permissions allow service-linked role creation.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity medium">Medium</span></td>
+            <td><span class="status error">Failed</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+            <td><code>123456789012</code></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
-<tr data-service="agentic" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td><code>us-east-1</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10232,10 +4742,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10243,10 +4760,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10254,10 +4778,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10265,10 +4796,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10276,10 +4814,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>Global</code></td>
             <td><code>AG-16</code></td>
-            <td class="col-domain">Agentic AI AgentCore Least Privilege</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: No roles with overly permissive AgentCore access found</td>
-            <td class="resolution-text">Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Least Privilege</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Over-permissive AgentCore principals can let agents or operators bypass intended autonomy and tool boundaries. Source check AC-02: No roles with overly permissive AgentCore access found</p></div>
+                        <div><strong>Resolution</strong><p>Replace full-access AgentCore permissions with least-privilege IAM policies scoped to required resources and actions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity high">High</span></td>
             <td><span class="status success">Passed</span></td>
         </tr>
@@ -10287,10 +4832,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>Global</code></td>
             <td><code>AG-17</code></td>
-            <td class="col-domain">Agentic AI Stale AgentCore Access</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</td>
-            <td class="resolution-text">Remove or restrict stale AgentCore permissions for principals that no longer need access.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Stale AgentCore Access</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Unused AgentCore permissions increase the blast radius of compromised principals. Source check AC-03: The following principals have AgentCore permissions but have never accessed the service: role 'AIMLSecurityMemberRole', role 'CloudSeerTrustedServiceRole'</p></div>
+                        <div><strong>Resolution</strong><p>Remove or restrict stale AgentCore permissions for principals that no longer need access.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10298,10 +4850,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10309,10 +4868,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10320,10 +4886,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10331,10 +4904,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10342,10 +4922,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10353,10 +4940,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10364,10 +4958,197 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-01</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/security/agentcore-vpc.md" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-04</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Observability Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/observability/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-05</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock/latest/userguide/key-management.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-06</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Browser Tool Recording Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Runtimes found to check browser tool configuration</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/browser/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-07</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Memory Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/memory/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-13</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Configuration Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateway resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://aws.github.io/bedrock-agentcore-starter-toolkit/user-guide/gateway/" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-08</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore VPC Endpoints Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-10</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Resource-Based Policies Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security_iam_service-with-iam.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-11</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Policy Engine Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
+            <td><span class="severity na">Informational</span></td>
+            <td><span class="status warning">N/A</span></td>
+        </tr>
+<tr data-service="agentcore" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-west-2">
+            <td><code>123456789012</code></td>
+            <td><code>us-west-2</code></td>
+            <td><code>AC-12</code></td>
+            <td class="finding-summary">
+                <div class="col-domain">AgentCore Gateway Encryption Check</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/data-encryption.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10375,10 +5156,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-24</code></td>
-            <td class="col-domain">Agentic AI Gateway Inbound Authorization</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Inbound Authorization</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10386,10 +5174,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-25</code></td>
-            <td class="col-domain">Agentic AI Gateway Tool Policy Enforcement</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Tool Policy Enforcement</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GatewayPolicyEngineConfiguration.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10397,10 +5192,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-26</code></td>
-            <td class="col-domain">Agentic AI Gateway Error Detail Exposure</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Error Detail Exposure</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10408,10 +5210,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-27</code></td>
-            <td class="col-domain">Agentic AI Gateway WAF Protection</td>
-            <td class="finding-details">No AgentCore Gateways found</td>
-            <td class="resolution-text">No action required</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway WAF Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No AgentCore Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>No action required</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_GetGateway.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10419,10 +5228,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-15</code></td>
-            <td class="col-domain">Agentic AI Runtime Network Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</td>
-            <td class="resolution-text">Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Runtime Network Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Agent runtimes should execute inside explicit network boundaries to reduce unintended external reachability. Source check AC-01: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore runtimes with appropriate VPC settings and restrict network paths to required services.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10430,10 +5246,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-18</code></td>
-            <td class="col-domain">Agentic AI AgentCore Observability</td>
-            <td class="finding-details">Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</td>
-            <td class="resolution-text">Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI AgentCore Observability</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Auditability & Observability. AgentCore observability provides the telemetry needed to investigate runtime, tool, memory, and gateway behavior. Source check AC-04: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Enable CloudWatch Logs, tracing, and AgentCore observability for runtime and gateway resources where supported.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10441,10 +5264,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-19</code></td>
-            <td class="col-domain">Agentic AI Memory Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</td>
-            <td class="resolution-text">Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Memory Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Memory & Data Privacy. Agent memory can contain sensitive user or business context and should use customer-controlled encryption where required. Source check AC-07: No Memory resources found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore memory resources with customer-managed KMS keys and review memory access permissions.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10452,10 +5282,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-20</code></td>
-            <td class="col-domain">Agentic AI Private AgentCore Connectivity</td>
-            <td class="finding-details">Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</td>
-            <td class="resolution-text">Create required VPC endpoints for AgentCore services and validate endpoint availability.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Private AgentCore Connectivity</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Bounded Autonomy. Private service connectivity reduces exposure for agents that access AgentCore control or runtime services. Source check AC-08: No AgentCore resources found</p></div>
+                        <div><strong>Resolution</strong><p>Create required VPC endpoints for AgentCore services and validate endpoint availability.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10463,10 +5300,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-21</code></td>
-            <td class="col-domain">Agentic AI Resource Policy Boundary</td>
-            <td class="finding-details">Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</td>
-            <td class="resolution-text">Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Resource Policy Boundary</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Agent Identity & Access. Resource-based policies add a second authorization boundary for AgentCore runtimes and gateways. Source check AC-10: No AgentCore resources found to check for resource-based policies</p></div>
+                        <div><strong>Resolution</strong><p>Attach resource-based policies to AgentCore resources to constrain principals, accounts, and network sources.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10474,10 +5318,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-22</code></td>
-            <td class="col-domain">Agentic AI Policy Engine Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</td>
-            <td class="resolution-text">Configure policy engines with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Policy Engine Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Policy engines contain authorization logic for tool calls and should be protected with appropriate encryption controls. Source check AC-11: No Policy Engines found</p></div>
+                        <div><strong>Resolution</strong><p>Configure policy engines with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10485,21 +5336,35 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>AG-23</code></td>
-            <td class="col-domain">Agentic AI Gateway Data Protection</td>
-            <td class="finding-details">Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</td>
-            <td class="resolution-text">Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</td>
-            <td class="reference-cell"><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">Agentic AI Gateway Data Protection</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>Agentic AI security domain: Tool Authorization. Gateway configuration can include tool schemas, target definitions, and integration metadata. Source check AC-12: No Gateways found</p></div>
+                        <div><strong>Resolution</strong><p>Configure AgentCore gateways with customer-managed KMS keys where enhanced key control is required.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div></section>
-            <section id="finserv" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span>Financial Services GenAI Risk Findings</div><div class="muted" style="margin:-6px 0 10px;font-size:13px;">Scope: this assessment records findings against each resolved CloudFormation TargetRegions entry. These checks are based on <a href="https://aws.amazon.com/blogs/security/introducing-the-updated-aws-user-guide-to-governance-risk-and-compliance-for-responsible-ai-adoption/" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>. Severities follow a documented Likelihood &times; Impact methodology (see docs).</div><div class="filter-bar"><div class="filter-group"><label>Search</label><input type="text" placeholder="Search findings..." id="finservSearchInput"></div><div class="filter-group"><label>Region</label><select id="finservRegionFilter"><option value="">All Regions</option><option value="ap-south-1">ap-south-1</option><option value="eu-west-1">eu-west-1</option><option value="sa-east-1">sa-east-1</option><option value="us-east-1">us-east-1</option><option value="us-west-2">us-west-2</option></select></div><div class="filter-group"><label>Severity</label><select id="finservSeverityFilter"><option value="">All Severities</option><option value="high">High</option><option value="medium">Medium</option><option value="low">Low</option><option value="informational">Informational</option></select></div><div class="filter-group"><label>Status</label><select id="finservStatusFilter"><option value="">All Statuses</option><option value="failed">Failed</option><option value="passed">Passed</option><option value="n/a">N/A</option></select></div><button class="btn btn-reset" id="finservResetFilters"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/></svg>Reset</button></div><div class="card"><div class="table-wrap"><table id="finservTable"><thead><tr><th>Account ID</th><th>Region</th><th>Check ID</th><th>Finding</th><th>Details</th><th>Resolution</th><th>Reference</th><th>Severity</th><th>Status</th></tr></thead><tbody><tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
+        </tr>
+<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="us-east-1">
             <td><code>123456789012</code></td>
             <td><code>us-east-1</code></td>
             <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in us-east-1; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10507,10 +5372,17 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>us-west-2</code></td>
             <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in us-west-2; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
         </tr>
@@ -10518,39 +5390,97 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             <td><code>123456789012</code></td>
             <td><code>eu-west-1</code></td>
             <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="ap-south-1">
-            <td><code>123456789012</code></td>
-            <td><code>ap-south-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in ap-south-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
-            <td><span class="severity na">Informational</span></td>
-            <td><span class="status warning">N/A</span></td>
-        </tr>
-<tr data-service="finserv" data-severity="informational" data-status="n/a" data-account="123456789012" data-region="sa-east-1">
-            <td><code>123456789012</code></td>
-            <td><code>sa-east-1</code></td>
-            <td><code>FS-00</code></td>
-            <td class="col-domain">FinServ Regional Scope Not Applicable</td>
-            <td class="finding-details">No regional Bedrock, AgentCore, or SageMaker resources were found in sa-east-1; FinServ GenAI risk checks were not applied to this region.</td>
-            <td class="resolution-text">No action required unless GenAI workloads are expected in this region.</td>
-            <td class="reference-cell"><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></td>
+            <td class="finding-summary">
+                <div class="col-domain">FinServ Regional Scope Not Applicable</div>
+                <details class="finding-more">
+                    <summary>Details and remediation</summary>
+                    <div class="finding-more-body">
+                        <div><strong>Details</strong><p>No regional Bedrock, AgentCore, or SageMaker resources were found in eu-west-1; FinServ GenAI risk checks were not applied to this region.</p></div>
+                        <div><strong>Resolution</strong><p>No action required unless GenAI workloads are expected in this region.</p></div>
+                        <div><strong>Reference</strong><p><a href="https://d1.awsstatic.com/onedam/marketing-channels/website/public/global-FinServ-ComplianceGuide-GenAIRisks-public.pdf" target="_blank" class="reference-btn" title="View AWS Documentation"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></a></p></div>
+                    </div>
+                </details>
+            </td>
             <td><span class="severity na">Informational</span></td>
             <td><span class="status warning">N/A</span></td>
-        </tr></tbody></table></div></div></section>
+        </tr></tbody></table></div></div>
+            </section>
+            <section id="bedrock" class="section">
+                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span>Amazon Bedrock Findings</div>
+                <div class="card"><div class="card-body">
+                    
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">4</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">1</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">84</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">89</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="bedrock" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="bedrock" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div>
+            </section>
+            <section id="sagemaker" class="section">
+                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span>Amazon SageMaker Findings</div>
+                <div class="card"><div class="card-body">
+                    
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">0</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">13</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">69</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">82</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="sagemaker" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="sagemaker" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div>
+            </section>
+            <section id="agentcore" class="section">
+                <div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span>Amazon Bedrock AgentCore Findings</div>
+                <div class="card"><div class="card-body">
+                    
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">1</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">1</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">31</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">33</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="agentcore" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="agentcore" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div>
+            </section>
+            <section id="agentic" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span>Agentic AI Security Findings</div><div class="card"><div class="card-body">
+                    <p class="finding-details" style="margin-bottom: 16px;">Scope: API-provable Agentic AI security controls mapped to the AWS Well-Architected Agentic AI Lens security guidance. Human-in-the-loop governance is referenced in methodology but not scored automatically unless an AWS API can prove the control.</p>
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">1</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">1</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">73</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">75</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="agentic" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="agentic" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div></section>
+            <section id="finserv" class="section"><div class="section-title"><span class="service-icon"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span>Financial Services GenAI Risk Findings</div><div class="card"><div class="card-body">
+                    <p class="finding-details" style="margin-bottom: 16px;">Scope: this assessment records findings against each resolved CloudFormation TargetRegions entry. These checks are based on <a href="https://aws.amazon.com/blogs/security/introducing-the-updated-aws-user-guide-to-governance-risk-and-compliance-for-responsible-ai-adoption/" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>. Severities follow a documented Likelihood &times; Impact methodology.</p>
+                    <div class="assessment-summary-grid">
+                        <div class="metric danger"><div class="metric-label">Failed</div><div class="metric-value">0</div><div class="metric-sub">Open findings</div></div>
+                        <div class="metric highlight"><div class="metric-label">Passed</div><div class="metric-value">0</div><div class="metric-sub">Controls met</div></div>
+                        <div class="metric"><div class="metric-label">N/A</div><div class="metric-value">3</div><div class="metric-sub">Not applicable</div></div>
+                        <div class="metric"><div class="metric-label">Total</div><div class="metric-value">3</div><div class="metric-sub">Rows in report</div></div>
+                    </div>
+                    <div class="assessment-actions">
+                        <button class="btn btn-reset" data-filter-service="finserv" data-filter-status="failed">View failed findings</button>
+                        <button class="btn btn-reset" data-filter-service="finserv" data-filter-status="">View all rows</button>
+                    </div>
+                </div></div></section>
             <section id="methodology" class="section">
                 <div class="section-title"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3"/><line x1="12" y1="17" x2="12.01" y2="17"/></svg>Assessment Methodology</div>
-                <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Severity Levels &amp; Status Values</h3></div><div class="card-body" style="padding: 12px 16px;"><table style="width: 100%; font-size: 12px;"><tbody><tr><td style="padding: 4px 12px 4px 0; width: 100px;"><span class="severity high">High</span></td><td style="padding: 4px 0; color: var(--text-2); width: 45%;">Direct security risk</td><td style="padding: 4px 12px 4px 24px; width: 60px;"><span class="status error">Failed</span></td><td style="padding: 4px 0; color: var(--text-2);">Remediation needed</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity medium">Medium</span></td><td style="padding: 4px 0; color: var(--text-2);">Defense-in-depth gap</td><td style="padding: 4px 12px 4px 24px;"><span class="status success">Passed</span></td><td style="padding: 4px 0; color: var(--text-2);">Meets requirements</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity low">Low</span></td><td style="padding: 4px 0; color: var(--text-2);">Best practice</td><td style="padding: 4px 12px 4px 24px;"><span class="status warning">N/A</span></td><td style="padding: 4px 0; color: var(--text-2);">Not applicable</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity na">Informational</span></td><td style="padding: 4px 0; color: var(--text-2);">No action required</td><td></td><td></td></tr></tbody></table></div></div>
-                <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Remediation Guidance</h3></div><div class="card-body" style="padding: 12px 16px;"><table style="width: 100%; font-size: 12px;"><tbody><tr><td style="padding: 4px 12px 4px 0; width: 80px;"><span class="severity high">High</span></td><td style="padding: 4px 0; color: var(--text-2); width: 60px;">7 days</td><td style="padding: 4px 0; color: var(--text-2);">Address immediately; block deployment if unresolved</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity medium">Medium</span></td><td style="padding: 4px 0; color: var(--text-2);">30 days</td><td style="padding: 4px 0; color: var(--text-2);">Schedule in next sprint; may require change window</td></tr><tr><td style="padding: 4px 12px 4px 0;"><span class="severity low">Low</span></td><td style="padding: 4px 0; color: var(--text-2);">90 days</td><td style="padding: 4px 0; color: var(--text-2);">Include in backlog; address during regular maintenance</td></tr></tbody></table></div></div>
                 <div class="card"><div class="card-header" style="padding: 12px 16px;"><h3 style="font-size: 14px;">Assessment Notes</h3></div><div class="card-body" style="padding: 12px 16px; font-size: 12px; color: var(--text-2); line-height: 1.6;"><strong style="color: var(--text);">Point-in-time:</strong> Security posture changes as resources are modified. <strong style="color: var(--text);">Scope limited:</strong> Passed checks verify tested controls only. <strong style="color: var(--text);">Context matters:</strong> Adjust severity for compliance requirements and environment type.</div></div>
                 <div class="card"><div class="card-header"><h3>Assessment Scope</h3></div><div class="card-body"><div style="display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 12px;"><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" transform="translate(12,12)" d="M52,26.999C50.897,26.999 50,26.103 50,25 50,23.897 50.897,23 52,23 53.103,23 54,23.897 54,25 54,26.103 53.103,26.999 52,26.999L52,26.999ZM20.113,53.908L16.865,52.014 23.53,47.848 22.47,46.152 14.913,50.875 9,47.426 9,38.535 14.555,34.832 13.445,33.168 7.959,36.825 2,33.42 2,28.58 8.496,24.868 7.504,23.132 2,26.277 2,22.58 8,19.152 14,22.58 14,26.434 9.485,29.143 10.515,30.857 15,28.166 19.485,30.857 20.515,29.143 16,26.434 16,22.535 21.555,18.832C21.833,18.646 22,18.334 22,18L22,11 20,11 20,17.465 14.959,20.825 9,17.42 9,8.574 14,5.658 14,14 16,14 16,4.491 20.113,2.092 28,4.721 28,33.434 13.485,42.143 14.515,43.857 28,35.766 28,51.279 20.113,53.908ZM50,38C50,39.103 49.103,40 48,40 46.897,40 46,39.103 46,38 46,36.897 46.897,36 48,36 49.103,36 50,36.897 50,38L50,38ZM40,48C40,49.103 39.103,50 38,50 36.897,50 36,49.103 36,48 36,46.897 36.897,46 38,46 39.103,46 40,46.897 40,48L40,48ZM39,8C39,6.897 39.897,6 41,6 42.103,6 43,6.897 43,8 43,9.103 42.103,10 41,10 39.897,10 39,9.103 39,8L39,8ZM52,21C50.141,21 48.589,22.28 48.142,24L30,24 30,19 41,19C41.553,19 42,18.552 42,18L42,11.858C43.72,11.411 45,9.858 45,8 45,5.794 43.206,4 41,4 38.794,4 37,5.794 37,8 37,9.858 38.28,11.411 40,11.858L40,17 30,17 30,4C30,3.569 29.725,3.188 29.316,3.051L20.316,0.051C20.042,-0.039 19.744,-0.009 19.496,0.136L7.496,7.136C7.188,7.315 7,7.645 7,8L7,17.42 0.504,21.132C0.192,21.31 0,21.641 0,22L0,34C0,34.359 0.192,34.69 0.504,34.868L7,38.58 7,48C7,48.355 7.188,48.685 7.496,48.864L19.496,55.864C19.65,55.954 19.825,56 20,56 20.106,56 20.213,55.983 20.316,55.949L29.316,52.949C29.725,52.812 30,52.431 30,52L30,40 37,40 37,44.142C35.28,44.589 34,46.142 34,48 34,50.206 35.794,52 38,52 40.206,52 42,50.206 42,48 42,46.142 40.72,44.589 39,44.142L39,39C39,38.448 38.553,38 38,38L30,38 30,33 42.5,33 44.638,35.85C44.239,36.472 44,37.207 44,38 44,40.206 45.794,42 48,42 50.206,42 52,40.206 52,38 52,35.794 50.206,34 48,34 47.316,34 46.682,34.188 46.119,34.492L43.8,31.4C43.611,31.148 43.314,31 43,31L30,31 30,26 48.142,26C48.589,27.72 50.141,29 52,29 54.206,29 56,27.206 56,25 56,22.794 54.206,21 52,21L52,21Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon Bedrock</span></div><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M54.034,26.034C54.034,26.594 53.578,27.05 53.017,27.05 52.458,27.05 52.002,26.594 52.002,26.034 52.002,25.474 52.458,25.018 53.017,25.018 53.578,25.018 54.034,25.474 54.034,26.034L54.034,26.034ZM48.002,36C48.002,35.449 48.45,35 49.002,35 49.554,35 50.002,35.449 50.002,36 50.002,36.551 49.554,37 49.002,37 48.45,37 48.002,36.551 48.002,36L48.002,36ZM48.002,55C48.002,54.449 48.45,54 49.002,54 49.554,54 50.002,54.449 50.002,55 50.002,55.551 49.554,56 49.002,56 48.45,56 48.002,55.551 48.002,55L48.002,55ZM58.002,42C58.002,42.551 57.554,43 57.002,43 56.45,43 56.002,42.551 56.002,42 56.002,41.449 56.45,41 57.002,41 57.554,41 58.002,41.449 58.002,42L58.002,42ZM65,45.272L59.963,42.382C59.979,42.256 60.002,42.131 60.002,42 60.002,40.346 58.656,39 57.002,39 55.347,39 54.002,40.346 54.002,42 54.002,43.654 55.347,45 57.002,45 57.801,45 58.523,44.681 59.061,44.171L63.886,46.939 59.555,49.105C59.216,49.275 59.002,49.621 59.002,50L59.002,58.441 46.983,65.837 41.003,62.42 41.003,56 46.186,56C46.6,57.161 47.7,58 49.002,58 50.656,58 52.002,56.654 52.002,55 52.002,53.345 50.656,52 49.002,52 47.7,52 46.6,52.838 46.186,54L41.003,54 41.003,40C41.003,39.649 40.818,39.323 40.517,39.142L35.516,36.142 34.487,37.857 39.003,40.566 39.003,43.507 33.002,48.123 33.002,44C33.002,43.696 32.864,43.408 32.627,43.219L28.002,39.519 28.002,34.535 33.556,30.832C33.835,30.646 34.002,30.334 34.002,30L34.002,24 32.002,24 32.002,29.465 27.013,32.79 22.002,29.464 22.002,21.575 27.002,18.659 27.002,27 29.002,27 29.002,17.492 33.005,15.157 39.001,18.616 39.002,31C39.002,31.359 39.194,31.69 39.506,31.868L46.042,35.603C46.024,35.734 46.002,35.864 46.002,36 46.002,37.654 47.347,39 49.002,39 50.656,39 52.002,37.654 52.002,36 52.002,34.346 50.656,33 49.002,33 48.208,33 47.49,33.315 46.953,33.82L41.002,30.419 41.001,18.618 46.964,15.177 58.002,22.536 58.002,25 55.851,25C55.429,23.845 54.318,23.018 53.017,23.018 51.354,23.018 50.002,24.371 50.002,26.034 50.002,27.697 51.354,29.05 53.017,29.05 54.343,29.05 55.471,28.191 55.875,27L58.002,27 58.002,30C58.002,30.36 58.194,30.691 58.506,30.869L65,34.58 65,45.272ZM33.02,65.837L29.867,63.897 35.583,59.814 34.421,58.186 28.018,62.759 21.002,58.441 21.002,50.566 25.516,47.857 24.487,46.142 19.958,48.86 15.002,46.383 15.001,40.617 20.449,37.894 19.555,36.105 15.001,38.381 15.002,34.58 20.963,31.175 26.002,34.519 26.002,39.48 20.449,43.167 21.555,44.833 26.958,41.245 31.002,44.48 31.002,49.662 26.392,53.207 27.611,54.792 39.003,46.03 39.003,62.419 33.02,65.837ZM66.496,33.132L60.002,29.42 60.002,22C60.002,21.666 59.835,21.354 59.556,21.169L47.556,13.169C47.24,12.959 46.832,12.945 46.502,13.135L40.004,16.885 33.502,13.135C33.19,12.955 32.807,12.955 32.498,13.137L20.498,20.137C20.19,20.316 20.002,20.645 20.002,21L20.002,29.42 13.506,33.132C13.194,33.31 13.002,33.641 13.002,34L13.002,34.417C13.001,34.438 13,34.458 13,34.479L13,45.363C13,45.383 13.001,45.403 13.002,45.422L13.002,47C13.002,47.379 13.216,47.725 13.555,47.894L19.002,50.618 19.002,59C19.002,59.347 19.181,59.669 19.477,59.851L32.477,67.851C32.638,67.95 32.82,68 33.002,68 33.173,68 33.344,67.956 33.498,67.868L40.003,64.152 46.506,67.868C46.821,68.049 47.213,68.042 47.526,67.851L60.526,59.851C60.822,59.669 61.002,59.347 61.002,59L61.002,50.618 66.447,47.894C66.786,47.725 67,47.379 67,47L67,34C67,33.641 66.807,33.31 66.496,33.132L66.496,33.132Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon SageMaker</span></div><div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; background: var(--surface-2); border-radius: 6px;"><span class="service-icon" style="width: 20px; height: 20px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#01A88D" width="80" height="80"/><path fill="#FFF" d="M67.372,28.073L64.178,26.792 62.933,23.634C62.781,23.252 62.412,23.001 62.002,23.001 61.591,23.001 61.222,23.253 61.071,23.636L59.814,26.838 56.638,28.071C56.253,28.22 55.999,28.592 56,29.005 56.001,29.419 56.257,29.79 56.643,29.937L59.89,31.178 61.063,34.348C61.205,34.735 61.572,34.995 61.985,35.001L62,35.001C62.407,35.001 62.774,34.754 62.928,34.375L64.231,31.142 67.36,29.934C67.743,29.786 67.997,29.418 68,29.007 68.003,28.597 67.754,28.226 67.372,28.073ZM63.106,29.432C62.849,29.532 62.643,29.734 62.539,29.991L62.04,31.228 61.607,30.058C61.508,29.788 61.296,29.574 61.027,29.471L59.782,28.996 60.947,28.543C61.207,28.442 61.414,28.237 61.516,27.977L62.004,26.732 62.435,27.822C62.523,28.142 62.767,28.398 63.079,28.506L64.269,28.983 63.106,29.432ZM64.053,38.6L54.914,34.935 51.351,25.902C51.123,25.325 50.575,24.953 49.955,24.953 49.335,24.954 48.786,25.327 48.56,25.905L44.958,35.083 42,36.23 42,16C42,15.569 41.725,15.188 41.316,15.051L32.316,12.051C32.042,11.961 31.744,11.991 31.496,12.136L19.496,19.136C19.189,19.315 19,19.645 19,20L19,29.42 12.504,33.132C12.192,33.31 12,33.641 12,34L12,46C12,46.359 12.192,46.69 12.504,46.868L19,50.58 19,60C19,60.355 19.189,60.685 19.496,60.864L31.496,67.864C31.65,67.954 31.825,68 32,68 32.106,68 32.213,67.983 32.316,67.949L41.316,64.949C41.725,64.813 42,64.431 42,64L42,43.738 45.2,44.961 48.561,54.046C48.777,54.632 49.32,55.017 49.945,55.026L49.969,55.026C50.584,55.026 51.128,54.66 51.359,54.087L55.089,44.845 64.035,41.392C64.614,41.168 64.991,40.623 64.995,40.001 64.999,39.381 64.629,38.831 64.053,38.6ZM32.113,65.908L28.865,64.014 35.53,59.848 34.47,58.186 26.913,62.759 21,58.441 21,50.566 26.555,46.832 25.445,45.168 19.959,48.825 14,45.42 14,40.58 20.496,36.868 19.504,35.132 14,38.277 14,34.58 20,31.152 26,34.58 26,38.434 21.485,41.143 22.515,42.857 27,40.166 31.485,42.857 32.515,41.143 28,38.434 28,34.535 33.555,30.832C33.833,30.646 34,30.334 34,30L34,24 32,24 32,29.465 26.959,32.825 21,29.42 21,20.574 26,17.658 26,27 28,27 28,16.491 32.113,14.092 40,16.721 40,45.434 25.485,54.143 26.515,55.857 40,47.766 40,63.279 32.113,65.908ZM53.964,43.135C53.706,43.235 53.501,43.438 53.397,43.694L49.988,52.14 46.918,43.842C46.818,43.572 46.607,43.358 46.338,43.255L42,41.597 42,38.375 46.09,36.788C46.351,36.687 46.558,36.481 46.659,36.221L49.957,27.818 53.14,35.886C53.209,36.252 53.486,36.548 53.84,36.659L62.129,39.983 53.964,43.135Z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Amazon Bedrock AgentCore</span></div></div><div class="scope-industry" data-scope-service="agentic"><div class="scope-industry-label">Agentic AI Security</div><div class="scope-chip-row"><div class="scope-chip industry-chip"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#0F766E" width="80" height="80"/><path fill="#FFF" d="M40 10 64 20v16c0 15-9.8 27.8-24 34-14.2-6.2-24-19-24-34V20l24-10zm0 8-16 6.7V36c0 10.4 6.1 19.9 16 25 9.9-5.1 16-14.6 16-25V24.7L40 18zm-8 17a8 8 0 1 1 14.9 4.1L52 48h-8l-3.2-5.3h-1.6L36 48h-8l5.1-8.9A8 8 0 0 1 32 35z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Agentic AI Security Lens Mapping</span></div></div></div><div class="scope-industry" data-scope-service="finserv"><div class="scope-industry-label">Industry</div><div class="scope-chip-row"><div class="scope-chip industry-chip"><span class="service-icon" style="width: 18px; height: 18px;"><svg viewBox="0 0 80 80" xmlns="http://www.w3.org/2000/svg"><rect fill="#7C3AED" width="80" height="80"/><path fill="#FFF" d="M40 14 L66 26 L66 31 L14 31 L14 26 Z M20 35 h6 v23 h-6 z M37 35 h6 v23 h-6 z M54 35 h6 v23 h-6 z M14 62 h52 v5 h-52 z"/></svg></span><span style="font-size: 13px; font-weight: 500;">Financial Services GenAI Risk</span></div></div></div><p style="color: var(--text-3); font-size: 12px;">Bedrock, SageMaker, and AgentCore checks are based on the <a href="https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/generative-ai-lens.html" target="_blank">AWS Well-Architected Framework Generative AI Lens</a>. Agentic AI Security references the <a href="https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html" target="_blank">AWS Well-Architected Agentic AI Lens</a>. Controls that cannot be proven using AWS APIs, including semantic human-in-the-loop workflow quality, are not automatically scored. Financial Services GenAI Risk checks are based on <a href="https://aws.amazon.com/blogs/security/introducing-the-updated-aws-user-guide-to-governance-risk-and-compliance-for-responsible-ai-adoption/" target="_blank">the AWS User Guide to Governance, Risk, and Compliance for Responsible AI Adoption</a>.</p></div></div>
             </section>
@@ -10609,7 +5539,7 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
             if (document.getElementById('regionFilter')) document.getElementById('regionFilter').value = '';
             document.getElementById('serviceFilter').value = '';
             document.getElementById('severityFilter').value = '';
-            document.getElementById('statusFilter').value = '';
+            document.getElementById('statusFilter').value = 'failed';
             applyFilters();
         });
         document.getElementById('searchInput').addEventListener('input', applyFilters);
@@ -10618,6 +5548,18 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
         document.getElementById('serviceFilter').addEventListener('change', applyFilters);
         document.getElementById('severityFilter').addEventListener('change', applyFilters);
         document.getElementById('statusFilter').addEventListener('change', applyFilters);
+        function filterFindings(service, status = 'failed') {
+            document.getElementById('serviceFilter').value = service || '';
+            document.getElementById('statusFilter').value = status;
+            applyFilters();
+            document.getElementById('findings').scrollIntoView({ behavior: 'smooth' });
+        }
+        document.querySelectorAll('[data-filter-service]').forEach(button => {
+            button.addEventListener('click', function() {
+                const status = this.hasAttribute('data-filter-status') ? this.dataset.filterStatus : 'failed';
+                filterFindings(this.dataset.filterService, status);
+            });
+        });
         window.addEventListener('scroll', () => {
             const sections = document.querySelectorAll('.section');
             let current = '';
@@ -10683,58 +5625,6 @@ <h4 style="font-size: 14px; font-weight: 600; color: var(--text-2); margin-botto
                 rows.forEach(row => tbody.appendChild(row));
             });
         });
-        // Service-specific filter functions
-        function createServiceFilter(tableId, searchId, accountId, regionId, severityId, statusId, resetId) {
-            const table = document.getElementById(tableId);
-            if (!table) return;
-            const searchInput = document.getElementById(searchId);
-            const accountFilter = document.getElementById(accountId);
-            const regionFilter = document.getElementById(regionId);
-            const severityFilter = document.getElementById(severityId);
-            const statusFilter = document.getElementById(statusId);
-            const resetBtn = document.getElementById(resetId);
-            function applyServiceFilters() {
-                const searchText = searchInput?.value.toLowerCase() || '';
-                const accountValue = accountFilter?.value.toLowerCase() || '';
-                const regionValue = regionFilter?.value.toLowerCase() || '';
-                const severityValue = severityFilter?.value.toLowerCase() || '';
-                const statusValue = statusFilter?.value.toLowerCase() || '';
-                const rows = table.querySelectorAll('tbody tr');
-                rows.forEach(row => {
-                    const rowText = row.textContent.toLowerCase();
-                    const rowAccount = row.dataset.account || '';
-                    const rowRegion = row.dataset.region || '';
-                    const rowSeverity = row.dataset.severity || '';
-                    const rowStatus = row.dataset.status || '';
-                    let show = true;
-                    if (searchText && !rowText.includes(searchText)) show = false;
-                    if (accountValue && rowAccount !== accountValue) show = false;
-                    if (regionValue && rowRegion.toLowerCase() !== regionValue) show = false;
-                    if (severityValue && rowSeverity !== severityValue) show = false;
-                    if (statusValue && rowStatus !== statusValue) show = false;
-                    row.style.display = show ? '' : 'none';
-                });
-            }
-            searchInput?.addEventListener('input', applyServiceFilters);
-            accountFilter?.addEventListener('change', applyServiceFilters);
-            regionFilter?.addEventListener('change', applyServiceFilters);
-            severityFilter?.addEventListener('change', applyServiceFilters);
-            statusFilter?.addEventListener('change', applyServiceFilters);
-            resetBtn?.addEventListener('click', function() {
-                if (searchInput) searchInput.value = '';
-                if (accountFilter) accountFilter.value = '';
-                if (regionFilter) regionFilter.value = '';
-                if (severityFilter) severityFilter.value = '';
-                if (statusFilter) statusFilter.value = '';
-                applyServiceFilters();
-            });
-        }
-        createServiceFilter('bedrockTable', 'bedrockSearchInput', 'bedrockAccountFilter', 'bedrockRegionFilter', 'bedrockSeverityFilter', 'bedrockStatusFilter', 'bedrockResetFilters');
-        createServiceFilter('sagemakerTable', 'sagemakerSearchInput', 'sagemakerAccountFilter', 'sagemakerRegionFilter', 'sagemakerSeverityFilter', 'sagemakerStatusFilter', 'sagemakerResetFilters');
-        createServiceFilter('agentcoreTable', 'agentcoreSearchInput', 'agentcoreAccountFilter', 'agentcoreRegionFilter', 'agentcoreSeverityFilter', 'agentcoreStatusFilter', 'agentcoreResetFilters');
-        createServiceFilter('agenticTable', 'agenticSearchInput', 'agenticAccountFilter', 'agenticRegionFilter', 'agenticSeverityFilter', 'agenticStatusFilter', 'agenticResetFilters');
-        createServiceFilter('finservTable', 'finservSearchInput', 'finservAccountFilter', 'finservRegionFilter', 'finservSeverityFilter', 'finservStatusFilter', 'finservResetFilters');
-
         // Apply initial filters for main table
         applyFilters();
     </script>
diff --git a/tests/test_bedrock_checks.py b/tests/test_bedrock_checks.py
index e139190..7c349aa 100644
--- a/tests/test_bedrock_checks.py
+++ b/tests/test_bedrock_checks.py
@@ -3403,7 +3403,7 @@ def test_br28_generates_ag01_mapping(self):
                         "Finding": "Bedrock Agent Guardrail Association",
                         "Finding_Details": "Agent has a guardrail associated.",
                         "Resolution": "No action required.",
-                        "Reference": "https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrails.html",
+                        "Reference": "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use.html",
                         "Severity": "High",
                         "Status": "Passed",
                         "Region": "us-east-1",