Weekly Review — June 22-28, 2026
written by Stefan Christoph
🎬 Also available as a blog walkthrough video — a short narrated tour of the week’s five posts.
This is the Weekly Review, a Sunday digest of everything that went up on the blog this week, plus a short list of things I read but didn’t write about. If you only have ten minutes on a Sunday, this is the one to read.
This Week on the Blog
MCP Strategies on AWS, Part 4: Governance in Code
Part four of the MCP series makes the governance pillar runnable. The canonical story: an admin asks an agent to clone a production database, the agent hallucinates a “cleanup” step that tries to delete production, and the only thing standing between a normal Tuesday and an incident is the token the tool holds. With a scoped read-create token the delete fails safely and production survives; with the admin’s own credentials reused, the same hallucination deletes it. A second demo adds per-tool rate limiting with the standard X-RateLimit headers. The honest caveat the post keeps front and center: token isolation limits the damage of a bad model step, it does not prevent the step.
Getting Paid by Agents: A Managed Paywall at the Edge
Part 2 of the agentic-commerce series built the buy side: an agent paying per article over x402 behind a 40-line hand-rolled Lambda paywall. This post flips to the seller’s seat using AWS WAF AI traffic monetization, which shipped on 15 June. It is a managed Monetize rule action that returns the 402, verifies the signed payment, fetches the content, and settles on-chain at the CloudFront edge, with no edge code to maintain. The rebuild is a differentiated pricing matrix (content tier by agent class) in a single web ACL, machine-readable license terms, and the exact same agent paying it with no shim. The hand-rolled version proved the protocol; the managed feature turns it into a publisher business model.
Give Every Agent Its Own Computer: AWS Lambda MicroVMs
AWS Lambda MicroVMs, launched 22 June, gives every user, job, or agent its own isolated, stateful compute environment: a Firecracker microVM with VM-level isolation, near-instant resume from a snapshot, and up to eight hours of suspend/resume state, all in one API call with no virtualization stack to operate. The post frames the old trade-off cleanly. You used to pick two of isolation, speed, and state, then build the third yourself. The demo shows the fix: Amazon Bedrock writes Python, a per-session microVM runs it, the state survives a suspend, and a second microVM stays sealed off. It is the clean answer to “where does my agent’s code actually run?”
I Rebuilt a Browser Fact-Checker on AWS, and AgentCore Web Search Was the Missing Piece
An open-source browser extension fact-checks videos and live streams in real time, and the post asks what it takes to rebuild that idea as an AWS-native service. The pipeline is the easy part (transcribe, extract claims, verify each, show a verdict) and the hard part has always been the verify step, which needs a model that can search the live web and cite what it found. Web Search on Amazon Bedrock AgentCore, GA since 19 June, is the managed, MCP-compatible piece that closes the gap: Claude on Bedrock reasons, AgentCore Web Search grounds it with dated, cited evidence, and the seam stays clean, with a claim going in and a verdict with evidence coming out.
Scrawl: Building a Tool for Humans and Agents
This one is the most personal and the most pointed. The author wanted a screen-annotation tool for presenting, and instead of an afternoon trialing apps, built exactly what they wanted with an AI agent: a tiny macOS overlay called Scrawl. Then came the part worth writing about, a second front door. Scrawl exposes a small loopback control API and a thin MCP wrapper, so an agent can drive the same drawing primitives a person uses through the toolbar. Two front doors, one shared core, a design stance that says a tool built in 2026 should assume both kinds of users from the start.
The Thread This Week
Read together, these five posts make one argument: the interesting work right now is plumbing agents into systems as real users. Each post takes a thing human users have always needed and asks what it looks like when the user is an agent. Permissions become scoped, purpose-built tokens. Payment becomes an x402 settlement at the edge. Compute becomes a microVM you launch per session. Grounding becomes a managed web-search tool any model can call. And the interface becomes a second front door over a shared core. It is notable how much of this the platform now hands you (three of the five builds lean on AWS features that became available within this single month) but the through-line isn’t the launches. It is that “treat the agent as a first-class user” turns out to be a concrete engineering checklist, not a slogan.
Further Reading
Things I read this week that didn’t get their own post, all public:
- Agent Identity: A New Access Model for Autonomous AI (Riggs Goodman III) — Gives agents their own principal instead of impersonating a user, so authorization shifts from “what can this user do” to “what can this agent do in this compartment.” The natural next chapter after this week’s governance post.
- Episodic Memory Consolidator on AgentCore (Davide Gallitelli) — A reference architecture where worker agents emit episodic memories and a nightly job consolidates recurring patterns into reusable skills. It reframes agent memory from “remember the conversation” to “consolidate experience into skill.”
- Markdown Knowledge Graphs as Agent Memory (Tony Seale) — Six months of working almost entirely from a linked markdown wiki plus an LLM, argued as a neuro-symbolic bridge where markdown is both the fuzzy neural representation and, with structure, the precise symbolic one.
- Multi-Agent Collaboration: 100+ Agents Optimizing an Open Model (Thomas Wolf) — A week-long open collaboration with 100+ agents that hit a 5x inference speedup and surfaced emergent social behavior: self-policing against social engineering, communal knowledge bases, and relay chains.
- Loop Engineering for Autonomous Agents (via Charly Wargnier) — A framework for autonomous loops: discover your own work, isolate it in git worktrees, verify with a second agent, persist to disk not context, and schedule on a timer. The shift is from prompting the agent to building the system that prompts it.
- Software Architecture x AI Engineering x Conway’s Law (Matthias Jung) — A look at whether Conway’s Law still holds when AI agents become part of the team topology, relevant to anyone designing around mixed human-and-agent teams.
- Unlimited-OCR (Baidu, open source) — A one-shot, long-horizon document-parsing model with multi-page PDF support, MIT-licensed and fast-growing. Worth a look if you’re comparing managed extraction services against open alternatives.
- Swami Sivasubramanian on AWS’s AI direction (interview signal) — A leadership read on where AWS is steering its agentic-AI and infrastructure narrative, useful context for the launches above.
- Stanford CS25: Introduction to Transformers (Andrej Karpathy) — A from-first-principles lecture on attention, why self-attention replaces recurrence, and the scaling hypothesis. A solid reference to send anyone who wants the foundations under all of the above.
Until Next Sunday
That’s the week. “Treat the agent as a first-class user” sounds like a tagline until you build it, and then it becomes a checklist: a token, a payment rail, a sandbox, a grounded search tool, a front door. Which of these would you have led with, and what did you build or read this week that treated an agent like a real user of your system?
About the Author
Stefan Christoph is a Principal Solutions Architect at AWS, focused on agentic AI, media & entertainment, and helping builders move from demo to production. He writes about AI architecture, developer productivity, and the future of software.
This is a personal blog. Opinions expressed here are my own and do not represent the views or positions of my employer.
🎬 Also available as a blog walkthrough video on YouTube
❤️ Created with the support of AI (Kiro)