A public-health developer needs help refactoring Bedrock client code while still owning architecture decisions for the outbreak FAQ service. Which development-tool pattern is appropriate?

A public-health developer refactoring Bedrock client code for an outbreak FAQ service can use Amazon Q Developer-class AI coding assistance to accelerate edits while retaining responsibility for civic architecture and review. The appropriate pattern treats AI coding tools as productivity aids under human ownership: they suggest SDK usage and refactors, but the developer still designs IAM, data flows, and approval gates for municipal systems.

Committing unreviewed AI-generated IAM wildcards directly to production fails by concept: automated suggestions are not an authorization decision and wildcards violate least privilege. Banning all developer assistance tools and retyping every SDK call from memory under time pressure fails pragmatically—it increases error rates without improving governance. Outsourcing architecture judgment entirely to an unsupervised model with no human approval gates fails Responsible AI and public-sector accountability requirements.

Exam caveat: AI coding assistance is not a substitute for security review, threat modeling, or peer approval on changes that touch PHI-adjacent outbreak content or production IAM. Generated code must still pass the same tests and policy checks as hand-written code; “accelerates refactoring” does not mean “auto-merges to main.”

Operational check: use the assistant to draft a Bedrock client refactor in a branch, run unit and policy-as-code checks, require human review of IAM and architecture diffs, and confirm no wildcard production roles were introduced before merge to the outbreak FAQ service.