Assess. Explain. Remediate, within guardrails.

This agent reviews your AWS account against the six Well-Architected pillars, explains risks in business and technical terms, and can execute a small set of pre-approved remediations on resources tagged SafeToModify=true. Everything else is refused or escalated for approval.