Wednesday, September 23, 2026

Chris van Eijk outlines six critical choices for building multi-tenant SaaS on PostgreSQL, covering isolation models, Row Level Security, indexing strategies, monetary data types, tenant restoration, and large-scale migration. The analysis provides measured comparisons to help engineers select the right architecture for their specific scale and compliance needs. It emphasizes practical trade-offs rather than theoretical best practices.

• Choose isolation models based on strict compliance vs. resource efficiency trade-offs.
• Implement RLS carefully to balance security overhead with query performance.
• Select indexing strategies that support multi-tenant filtering without bloat.
• Use appropriate money types to avoid precision issues in financial data.
• Plan restoration and migration paths early to minimize tenant downtime.

Chris van Eijk analyzes how Row-Level Security, though easy to enable, often fails silently in PostgreSQL 17. The article details five specific scenarios where tenant data leaks despite configuration, highlighting edge cases in policy enforcement. This review serves as a practical audit guide for ensuring strict multi-tenancy isolation.

• Enabling RLS is trivial, but verifying its persistence against policy changes is critical.
• Five distinct leak paths exist where tenant boundaries are silently breached in v17.
• Audit existing policies for edge cases that bypass row-level filtering mechanisms.
• Assume RLS is broken until specific edge-case scenarios are explicitly tested.

Dimitri Fontaine reflects on the decade since Postgres 10 introduced logical replication, contrasting it with the complex, multi-daemon setups of Londiste and PgQ. He notes that every release since 2017 has replaced manual plumbing with declarative SQL, simplifying data distribution. This article launches a series exploring modern use-cases and the evolution of the feature set.

• Logical replication has replaced complex trigger-based queues like PgQ and Londiste with native SQL commands.
• Postgres 19 marks the 10th anniversary of this feature, highlighting a decade of incremental stabilization.
• The shift reduces operational overhead by eliminating Python daemons and per-node ticker processes.
• New series will cover practical use-cases now that the underlying plumbing is standardized.

OpenAI's GPT-6 Sol and GPT-6 Luna models are generally available on Amazon Bedrock, expanding the GPT-6 family. Sol targets recurring complex tasks and software development with improved factuality, while Luna offers high efficiency for high-volume operations like summarization and routing. Both models support a 1 million token context window and are optimized for production security and scale.

• GPT-6 Sol reduces factuality errors by roughly half compared to GPT-5.6 Sol
• GPT-6 Luna is optimized for high-volume tasks like classification and extraction
• Both models support up to 1M tokens of context for long-running workflows
• Bedrock provides the necessary infrastructure for secure, scalable production use

AWS GovCloud (US) has added support for Claude Opus 5.5, the latest iteration of Anthropic's Opus family. This model is optimized for long-running coding and knowledge tasks, offering improved efficiency by using fewer tokens than its predecessor. Additionally, it features reduced pricing per token and cheaper cache read operations to further lower inference costs.

• Claude Opus 5.5 is now available in AWS GovCloud (US) for enterprise workloads.
• The model uses fewer tokens than Opus 5, reducing overall inference costs.
• Cheaper cache reads provide additional efficiency gains for repeated queries.
• Designed for long-running coding and knowledge work with clear status reporting.

Researchers introduce RAG-NAROK, a new adversarial attack targeting Retrieval-Augmented Generation systems by exploiting their dynamic retrieval pipeline. Unlike previous static poisoning methods that inject documents blindly, this approach generates source-specific refutations tailored to the actual context retrieved for a given query. The attack remains effective against the competitive documentary landscape surrounding the payload in the generator's context window.

• RAG systems face new vulnerabilities due to dynamic retrieval pipelines, not just static knowledge bases.
• Attacks are now source-specific and aware of the competitive context retrieved alongside the payload.
• Static poisoning defenses are insufficient; context-aware adversarial examples bypass existing safeguards.
• This work highlights the need for retrieval-time integrity checks in RAG architectures.

Orthrus is a serving system that addresses low throughput and poor GPU utilization by executing embedding and generative models in a unified inference loop. It overcomes conflicting computational patterns through chunked embedding and optimized batch composition. This approach eliminates the inefficiencies of coarse-grained partitioning and dynamic workload bubbles.

• Unifies embedding and generation models in one inference loop
• Uses heterogeneous batching to boost GPU utilization
• Eliminates computational bubbles from isolated model execution
• Adapts to dynamic workloads without coarse-grained partitioning

This paper introduces latent equivalence learning to bridge the gap between semantic reasoning and structure prediction in enterprise data agents. Instead of relying on reusable markdown-style memory files, the framework separates persistent task-relevant identities from recurring structural patterns. This division of labor allows agents to focus on reasoning while learned systems handle the organization of complex, distributed data schemas and relationships.

• Replaces static markdown memory with learned structural prediction for recurring data patterns.
• Separates semantic reasoning from schema organization to improve agent efficiency.
• Addresses complex enterprise environments with distributed schemas and business roles.
• Reduces redundant discovery by persisting task-relevant identities via latent equivalence.

A new arXiv study reveals that repeated agent tasks suffer from high inconsistency, with up to 74% of outputs disagreeing across runs. To address this, the authors propose 'skill habit formation,' where agents analyze their own execution history to extract deterministic skill variants. These candidates compete against existing methods by declaring specific input regions, allowing common cases to execute as fast scripts while falling back to reasoning for edge cases.

• Re-running identical tasks yields inconsistent results in 38-74% of cases across different models.
• Skill habits are mined from execution history rather than manually coded by developers.
• Candidates declare their input space regions to compete with incumbent methods dynamically.
• Common cases execute as deterministic scripts, while complex inputs fall back to reasoning.
• This approach aims to reduce the 95%+ waste from re-deriving known plans.

ZeroGate decouples authorization from admission to shorten dispatch boundaries without removing security checks. An issuer signs a short-lived ActionPass, which a trusted runtime adapter reconstructs and validates against a local gate using a nonce and binding check. A SQLite transaction ensures atomicity for nonce consumption, quota updates, and admission receipts, preserving synchronous policy decisions.

• Decouples authorization from admission to reduce agent dispatch latency.
• Uses short-lived ActionPass signatures for fast, traceable local validation.
• SQLite transactions atomically handle nonces, quotas, and admission receipts.
• Maintains trust by ensuring local admission implies synchronous policy approval.

AWS Continuum now allows security teams to validate login credentials and receive accessible domain suggestions before starting a penetration test. This proactive validation helps define an accurate network scope immediately, preventing misconfigurations that previously required manual effort. By catching authentication failures and identifying valid targets early, the tool eliminates wasted test cycles and accelerates the secure development lifecycle.

• Validate login credentials during test configuration to ensure the agent can authenticate successfully.
• Receive suggested domains upfront to define an accurate network scope without manual discovery.
• Reduce wasted test cycles by catching authentication failures before the full penetration test runs.
• Minimize configuration errors that lead to incomplete or inaccurate security assessments.

PostgreSQL has launched pgsql-test to enable faster development loops for database logic, addressing the friction developers face when provisioning state and managing transactions. The tool aims to close the gap between application-level testing and database enforcement, which often leads to business rules being pushed into application code. Mocks are insufficient for this purpose as they cannot exercise foreign keys, triggers, row-level security policies, or actual role permissions.

• Shifting logic back to the database becomes viable when testing is as fast as application code.
• Mocking fails to validate actual database behaviors like triggers, FKs, and RLS policies.
• Reduced friction encourages enforcing rules in Postgres rather than application layers.
• Developers can now get red-green feedback directly within database logic workflows.

Amazon SNS has increased its maximum message payload size from 256 KiB to 1 MiB, a fourfold expansion. This change allows publishers to send larger data units directly without pre-splitting or offloading, which was previously required for larger workloads. The new 1 MiB limit applies to both Standard and FIFO topics via the MaximumMessageSize attribute.

• Payload limit increased 4x from 256 KiB to 1 MiB for SNS topics.
• Applies to both SNS Standard and FIFO topic types.
• Configure via the new MaximumMessageSize topic attribute.
• Reduces need to split or offload large messages before publishing.
• Beneficial for AI, IoT, and app integration workloads with larger data units.

Amazon ECS now surfaces live deployment tracking directly within the AWS Management Console, eliminating the need to switch tools for monitoring. The new feature provides a chronological timeline of deployment phases, task lifecycle events, and traffic shift distribution across revisions. This allows engineers to observe health status and diagnose failures in real time for native Linear, Canary, and Blue/Green strategies.

• Monitor Linear, Canary, and Blue/Green deployments directly in the ECS Console without external tools.
• View a live timeline of deployment phases, task launches, terminations, and traffic shifts.
• Diagnose failures and track health status in real time during the rollout process.
• Consolidate monitoring and troubleshooting workflows into a single interface.

AWS has generally available Amazon CloudWatch Omni, an AI-driven evolution of CloudWatch designed to unify observability for applications and agents. The service integrates OpenTelemetry interoperability with CloudWatch’s scale, offering a centralized view across AWS, Azure, and multi-account environments. Users can access telemetry via a standalone web portal with SSO or a local IDE extension for direct agent interaction.

• Unified AI-first interface for observing both traditional apps and autonomous agents in one place.
• Leverages OpenTelemetry for broad interoperability while maintaining CloudWatch’s reliability and scale.
• Multi-cloud support extends visibility to Azure workloads alongside AWS accounts and Regions.
• IDE extension enables hands-on agent troubleshooting directly within your local development environment.

AWS Security Hub AI Inventory now discovers and catalogs AI assets on self-hosted Microsoft Azure instances. The update leverages enhanced Amazon Inspector SBOM analysis to identify inference endpoints, models, and agents like Ollama and vLLM on Azure VMs. This allows central security teams to maintain a unified, continuously updated view of multi-cloud AI security posture.

• Security Hub now covers Azure self-hosted AI workloads, not just AWS.
• Uses Amazon Inspector SBOM analysis to detect frameworks like Ollama and vLLM.
• Maps discovered AI assets to underlying infrastructure for better visibility.
• Correlates AI assets with security findings for centralized risk management.
• Enables filtering of multi-cloud AI security posture in one dashboard.

AWS Glue Data Quality now leverages generative AI to automatically suggest data quality rules in seconds. The new Advanced mode analyzes table intent to propose business-relevant checks across every column in the Data Catalog. This eliminates manual setup, allowing engineers to quickly bootstrap checks for new datasets or large data lakes.

• Generative AI detects data intent and proposes relevant quality rules automatically.
• Full column coverage is achieved instantly without manual rule authoring.
• Ideal for bootstrapping checks on new datasets or large-scale data lakes.
• Users retain control to review, adjust, and save recommended rules.

Amazon EC2 X8i instances are now available in the South America (Sao Paulo) region. Powered by custom Intel Xeon 6 processors, these instances deliver up to 43% higher performance and 3.3x more memory bandwidth than the previous generation X2i instances. They are designed for memory-intensive workloads such as SAP HANA, large databases, and data analytics.

• X8i instances are now available in the South America (Sao Paulo) region.
• Powered by custom Intel Xeon 6 processors exclusive to AWS.
• Delivers up to 43% higher performance and 3.3x more memory bandwidth than X2i.
• Supports memory-intensive workloads like SAP HANA and large databases.
• Offers up to 1.5x more memory capacity, reaching up to 6TB per instance.

AWS has extended Amazon ECS Express Mode to support ARM64 CPU architectures, allowing users to deploy container images optimized for AWS Graviton processors. This update enables faster launch of containerized applications like web apps and APIs while leveraging Graviton's hardware advantages. The service continues to automate infrastructure setup, including networking, load balancing, and auto-scaling, but now with the option to choose ARM-based compute.

• ECS Express Mode now accepts ARM64 architecture specifications for container services.
• Deployments can target AWS Graviton instances for up to 40% better price-performance.
• Automation features like load balancing and auto-scaling remain fully supported for ARM workloads.
• Developers can now select compute architecture based on workload efficiency needs.

AWS Resilience Hub has updated its capabilities to better support platform engineering and SRE teams. The new features include using EKS namespace labels as service input sources, automated dependency insights, and the ability to share resilience policies across organizations via AWS Organizations. These additions aim to streamline workload resilience assessment and strengthening.

• Use EKS labels in namespaces to precisely scope service inputs for resilience assessments.
• Leverage new dependency insights to understand workload relationships and failure points.
• Share standardized resilience policies across the organization using AWS Organizations.
• Centralize resilience posture reporting for better visibility into workload health.

The claude-code-templates repository provides a CLI tool to install pre-built configurations for Anthropic's Claude Code. It bundles AI agents, custom commands, hooks, and project templates to streamline development workflows. The project highlights integration with Bright Data, offering specific skills and MCPs for web search, scraping, and structured data feeds.

• Installs ready-to-use Claude Code configs via npx for immediate workflow enhancement.
• Bundles AI agents, custom commands, and hooks to reduce setup time for developers.
• Includes specific Bright Data MCP integration for web scraping and data feeds.
• Serves as a central repository for community-shared Claude Code templates and settings.