# Fable 5.1 on Bedrock: data retention is now an architecture decision

Claude Fable 5.1 landed on Bedrock on September 1, 2026 with a 1M-token context window and a condition no prior Anthropic model carried: you must explicitly authorize retention of prompts and outputs for up to 30 days inside the AWS boundary. This is not a consent checkbox — it is an account-scoped setting with organizational blast radius, and it collides head-on with the zero-data-retention SCP most regulated environments already have written.

- URL: https://fernando.moretes.com/blog/fable-5-1-no-bedrock-retencao-de-dados-virou-decisao-de-arquitetura-aws-weekly-r

- Markdown: https://fernando.moretes.com/blog/fable-5-1-no-bedrock-retencao-de-dados-virou-decisao-de-arquitetura-aws-weekly-r/article.md?lang=en

- Published: 2026-09-08T10:16:18.030Z

- Category: AI & Agents

- Tags: bedrock, anthropic, governance, data-residency, iam, scp, finops, llmops

- Reading time: 8 min

- Source: [AWS Weekly Roundup: Claude Fable 5.1 on AWS, Amazon Linux 2027 preview, AWS Certified AI Business Strategist, and more (September 7, 2026)](https://aws.amazon.com/blogs/aws/aws-weekly-roundup-claude-fable-5-1-on-aws-amazon-linux-2027-preview-aws-certified-ai-business-strategist-and-more-september-7-2026/)

---

The September 7 AWS Weekly Roundup filed Claude Fable 5.1 as one more model launch between EC2 R9g and Amazon Linux 2027. It isn't. For the first time on a frontier model in Bedrock, the key that unlocks access lives neither in IAM nor in the Marketplace — it lives in an account-scoped data retention setting that you have to flip through the API, because there is no console UI for it. I spent the week reading the `data-retention` and `abuse-detection` docs line by line, and the conclusion is uncomfortable for anyone operating under regulation: enabling Fable 5.1 is a landing-zone decision, not a product-team decision.

## What actually changed — and what didn't

Bedrock has always sold itself on two security models: **zero operator access** (no service operator can read model input or output) and **zero data retention** by default. The abuse detection doc still asserts both. What Anthropic introduced with the **Covered Model** category is a named exception: for Claude Fable 5 and Fable 5.1, *all* traffic is retained for up to 30 days for automated offline abuse detection, and classifier-flagged traffic is subject to human review performed by AWS.

Two things that did not change, worth repeating because a hurried reading gets both wrong. First: **your content does not go to Anthropic.** The `provider_data_share` mode is legacy, and the doc itself states that sharing content with model providers is not supported today — it grants a permission nobody exercises. Second: **nothing changes for Claude models released before Fable 5.** The doc is explicit, and the mechanism is elegant: each model declares its own `allowed_modes`, so an account set to `aws_review` that also calls Opus 4.8 retains nothing from Opus — Opus permits `none`, and `none` wins for it.

The friction isn't what AWS does with the data. It's that the authorization to do it lives in a scope most teams don't control.

## How the effective mode resolves and where the model gets blocked

Resolution is hierarchical: the first scope whose value is not `inherit` wins. If the effective mode lands below the model's minimum, the model shows up as `status: "unavailable"` in the model list — not a permission error, but the model quietly leaving your catalog.

### 🔐 Governança — o que a organização permite

- SCP Deny em bedrock:DataRetentionMode (security)
- IAM PutAccountDataRetention · UpdateProject (security)

### 🟧 AWS — resolução do modo efetivo

- Projeto mais específico · pode ser inherit (compute)
- Conta PUT /v1/data_retention (compute)
- Padrão do modelo somente leitura (data)

### 🤖 Bedrock — a trava de disponibilidade

- allowed_modes none < default < aws_review < provider_data_share (ai)
- Claude Fable 5.1 exige aws_review ou superior (ai)
- status: unavailable status_reason explica o motivo (external)

### 📦 Fronteira de retenção — 30 dias dentro da AWS

- Prompts e saídas até 30 dias · região de destino do CRIS (storage)
- Detecção de abuso offline automatizada · todo o tráfego (security)
- Revisão humana pela AWS só tráfego marcado por classificador (security)
- Enterprise Frontier Safeguards ZDR até 31/12/2026 (security)

### Flows

- scp -> acct: caps which modes can be written
- iam -> proj: who may change the scope
- proj -> acct: if inherit, defer
- acct -> mdef: if inherit, defer
- acct -> gate: effective mode
- app -> gate: inference call
- gate -> fable: mode ≥ aws_review
- gate -> unavail: mode none or default
- fable -> store: writes input and output
- store -> auto: scans full volume
- auto -> human: escalates classifier hits
- efs -> store: suspends retention while eligible

## The four modes, and what each one costs in governance
| Criterion | Mode | What happens to the data | Does Fable 5.1 work? |
| --- | --- | --- | --- |
| `none` | Zero retention. Nothing is written to durable storage. On the Responses API, `store=true` is rejected. | No — the request is blocked. | — |
| `default` | The model's own policy applies. If ZDR applied before, it still does. `store=false` does not guarantee zero retention. | No — it shows up as `unavailable`. | — |
| `aws_review` | Retained up to 30 days inside the AWS boundary; AWS may review. The provider receives nothing. | Yes — this is the minimum required. | — |
| `provider_data_share` (legacy) | In practice identical handling to `aws_review`: provider sharing is not supported today. | Yes — it sits higher in the ordering and already satisfies it. | — |
| `inherit` | No opinion at that scope; defers to a broader one. It is the default for new accounts and projects. | Depends on what sits above. | — |

## The account became the isolation boundary — and your SCP already said no

If you work under BACEN 4.893, PCI-DSS or LGPD, odds are your organization already has an SCP denying anything that writes prompts to durable storage. The Bedrock docs even publish that SCP as an example, denying `bedrock-mantle:PutAccountDataRetention` whenever `bedrock-mantle:DataRetentionMode` is anything other than `none`. That SCP is correct — and it makes Fable 5.1 permanently unavailable across the whole OU.

What bothers me isn't the block; it's the granularity. The mode resolves across **project → account → model default**, and the only practical command today is `aws bedrock put-account-data-retention --mode aws_review`, which applies to the entire account. Turning Fable 5.1 on in the shared production account authorizes AWS human review over *every* workload that runs on a model requiring review, indefinitely, until someone remembers to turn it off. Project scope exists precisely to avoid that, and it is the only reason I would consider enabling this without cutting a new account.

The practical recommendation inverts the instinct: **don't ask for an SCP exception — ask for an account.** A dedicated account, inside its own OU with an SCP that permits `aws_review` and nothing beyond it, gives you a named blast radius, a separate bill, and a one-line audit answer. An exception carved into a production OU's SCP is debt nobody audits later.

## Data residency: outside the US, the Global profile is not a choice

This is the part every piece of coverage I read missed, and it is the most serious one for anyone operating in Brazil or Europe. The Fable 5.1 model card lists the `bedrock-runtime` endpoint with **In-Region unsupported in every Region on earth**. The Geo profile (`us.anthropic.claude-fable-5-1`) exists only in the US, Canada and GovCloud. In `sa-east-1`, `eu-central-1`, `eu-west-1` and everywhere else, the only open door is the Global profile — `global.anthropic.claude-fable-5-1`, which routes inference anywhere in the world.

Now pair that with a sentence in the abuse detection doc: if cross-region inference is enabled, retained inputs and outputs are stored **in the destination Region**, meaning wherever the request was processed. Put the two together and the result is blunt: a bank in São Paulo calling Fable 5.1 is authorizing 30-day retention of prompts in a Region it did not pick and cannot predict per request. That is not a latency footnote — it is a data-residency assertion that belongs in your DPIA before any proof of concept.

For residency-constrained shops the options are short and none are free: run through the US Geo profile and classify the data as transferred, negotiate Enterprise Frontier Safeguards eligibility while it still grants ZDR, or accept that Fable 5.1 stays outside the regulated perimeter and serves workloads with no personal data — code generation over an internal repository, for instance.

## The playbook for tomorrow morning

1. **Find out which mode your accounts are already in** — Before discussing anything, run `GET /v1/data_retention` on every account with Bedrock enabled. Older accounts sitting on `provider_data_share` are already above `aws_review` in the ordering — they gain Fable 5.1 access without anyone having approved anything. That finding usually changes the meeting.

2. **Pick the scope before the mode** — Project beats account, account beats model default. If you need a pilot, set `data_retention` on the project through `POST /v1/organization/projects/{project_id}` and leave the account on `inherit` or `none`. Never start at the account.

3. **Write the SCP before flipping the mode** — The `bedrock:DataRetentionMode` condition key (and `bedrock-mantle:DataRetentionMode`) exists for exactly this. An SCP that permits `aws_review` and denies `provider_data_share` stops anyone from escalating back to the legacy mode out of habit.

4. **Pin the inference profile in code** — There is no In-Region endpoint. Explicitly choose between `us.anthropic.claude-fable-5-1` and `global.anthropic.claude-fable-5-1` and document the reason next to the data that flows through it. Leaving that to an ownerless environment variable is how global routing reaches production unreviewed.

5. **Fix your sampling parameters before the first deploy** — `temperature` must be 1.0 or unset, `top_p` 0.99 or unset, the two cannot be sent together, and `top_k` is unsupported. A wrapper that copies your Sonnet parameters breaks on the first call — and it breaks in production, not in the unit test that mocks the client.

6. **Treat `stop_reason: "refusal"` as a primary path** — The model returns HTTP 200 with `stop_reason: "refusal"` and a `stop_details` object carrying the category. The docs warn that refusal rates are materially higher than on previous Claude models. Code that only inspects the HTTP status will hand the user an empty response and log nothing.

7. **Put December 31, 2026 on the calendar** — Enterprise Frontier Safeguards makes eligible customers ZDR **through December 31, 2026**. After that, all traffic returns to being retained for up to 30 days for automated offline abuse detection. If your compliance sign-off depends on ZDR, it has an expiry date.

> **The cache checkpoint that fails silently:** Fable 5.1 prompt caching accepts at most 4 checkpoints per request, with a 5-minute or 1-hour TTL, across the `system`, `messages` and `tools` fields. The expensive detail: the minimum is **512 tokens per checkpoint**, and below that caching is disabled with no error at all — the response comes back normal, with cache counters at zero. In an agent that runs for hours, that is the difference between reusing your system prompt and paying for it at every step. Instrument `cacheReadInputTokens` and `cacheWriteInputTokens` as first-class CloudWatch metrics, not as log fields: with no alarm, a refactor that shortened the system prompt by 40 tokens disappears into the noise and surfaces only on the invoice.

## The real cost: adaptive thinking, billed refusals, and an endpoint without guardrails

Fable 5.1's adaptive reasoning is **always on and cannot be disabled**; what you control is the effort level — `low`, `medium`, `high`, `xhigh`, `max`, defaulting to `high`. A public Converse test with `{"output_config":{"effort":"max"}}` showed the jump: 410 thinking tokens against zero on the default call, with latency moving from ~8.3s to ~13.7s. Thinking tokens are billed output tokens. A miscalibrated `effort` inside an agent loop doesn't raise your bill by 10% — it raises it by multiples, and the only evidence is a `usage` block nobody aggregates.

The second cost leak is refusal. Prompt-stage refusals, blocked before inference begins, are not billed. Mid-stream refusals, after partial output, **are billed for the tokens generated before the block**. With a materially higher refusal rate coming from the cybersecurity and life-sciences classifiers, a vulnerability-analysis pipeline can pay for output the user never saw.

And there is an endpoint choice that reshapes the whole architecture: on `bedrock-mantle`, Fable 5.1 supports **neither Guardrails nor Knowledge Bases nor Agents nor the Converse API** — only streaming, prompt caching and token counting. Bedrock Guardrails exist only through `bedrock-runtime`. If you need your own content filter in front of the model, there is no decision to make; `bedrock-runtime` is the only path, and it's the one the docs recommend for new applications anyway.

## Anti-patterns already taking root in week one

- **Flipping `aws_review` on the shared production account**: the mode is account-scoped, not per request. One CLI line authorizes retention and review over every future workload on any model requiring review — including workloads not yet written.
- **Treating legacy `provider_data_share` as harmless because nothing is shared**: it is the *most permissive* mode in the ordering. An account sitting on it since 2024 unlocks Covered Models with nobody having reviewed the decision.
- **Assuming `global.` is just a latency optimization**: outside the US and Canada it is the only option, and it decides which Region holds your prompts for 30 days. That is a residency decision disguised as a model ID prefix.
- **Reusing your Sonnet client with `temperature: 0.2` and `top_k`**: Fable 5.1 requires `temperature` at 1.0 or unset and does not support `top_k`. Determinism through low temperature is not a lever here; use output structure and validation instead.
- **Counting on Guardrails at the `bedrock-mantle` endpoint**: they do not exist there. Discovering it after the security design has been signed off costs a redesign, not a patch.
- **Measuring cost without separating thinking tokens**: reasoning cannot be turned off and the default is `high`. Without `effort` and `usage` as dimensions on your cost metric, you cannot explain the bill even a day later.

## Questions that came up in week one

### My account is on `provider_data_share`. Do I need to migrate to use Fable 5.1?

No. Since `provider_data_share` sits above `aws_review` in the ordering, it already satisfies the requirement and nothing breaks. It is still worth migrating: `aws_review` describes the behavior that actually happens, and in an audit report the gap between "we authorized sharing with the provider" and "we authorized review by AWS" is the gap between a question and a meeting.

### Can I use Fable 5.1 and keep zero data retention?

Only by exception. The Enterprise Frontier Safeguards program grants eligible customers ZDR through December 31, 2026, and the roadmap mentions customer-managed keys and bring-your-own-bucket storage for abuse detection. Outside it, ZDR eligibility for Claude models is evaluated per account and per model, and Anthropic is the decision maker — talk to their representative, not only to AWS.

### Where do I configure this in the console?

Nowhere. The docs state explicitly that at launch there is no console UI for data retention — API or SDK only. In practice that's a feature: it forces the change through infrastructure as code and leaves a CloudTrail trail, instead of becoming one click by whoever has console access.

### Does turning on `aws_review` make my other models start retaining data?

No. Each model declares its own `allowed_modes`, and a model that permits `none` — Opus 4.8, for instance — retains nothing no matter how permissive the account setting is. The mode states what you *allow*, not what happens. Even so, isolate by project: the audit will ask what you permitted, not what occurred.

> **What I would do on Monday:** I would not carve an exception into the production OU's SCP — I would open an account. A dedicated account, its own OU, an SCP that permits exactly `aws_review` and nothing above it, `global.anthropic.claude-fable-5-1` pinned in code with a comment saying why, and no customer data crossing into it. The hard-won lesson behind that came from elsewhere: every exception I ever carved into a production OU policy outlived the project that justified it and became an orphan permission nobody could explain two years later. An account is revocable, carries its own bill, and answers the audit in one line. And before any pilot I would run `GET /v1/data_retention` across every account with Bedrock enabled — I'd bet at least one has been on `provider_data_share` forever, holding Covered Model access nobody approved.

## Verdict

Fable 5.1 delivers on the axis that matters for long-horizon agents: a 1M-token context window, 128K max output, a June 2026 knowledge cutoff, and reasoning effort configurable across five levels. If your workload is code generation and review over an internal repository with no personal data, adopt it — in a dedicated account, with the project set to `aws_review`, the inference profile pinned, and `stop_reason: "refusal"` handled as a normal path. If your workload touches customer data under LGPD or BACEN and you sit outside the US, the verdict inverts, and it's a condition rather than an opinion: the only available profile is Global, the 30-day retention lands in whichever Region processed the request, and that belongs in a signed impact assessment before the first call. It isn't the model that is unavailable to regulated environments — it's the retention mode that doesn't yet have the granularity regulated environments require. Enterprise Frontier Safeguards is the bridge, and it has an expiry date: December 31, 2026.

**Rating:** Adote com escopo isolado — bloqueado por

## References

- [AWS Weekly Roundup: Claude Fable 5.1 on AWS, Amazon Linux 2027 preview, and more (Sept 7, 2026)](https://aws.amazon.com/blogs/aws/aws-weekly-roundup-claude-fable-5-1-on-aws-amazon-linux-2027-preview-aws-certified-ai-business-strategist-and-more-september-7-2026/)
- [Amazon Bedrock User Guide — Data retention (modes, ordering, SCP condition keys)](https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html)
- [Amazon Bedrock User Guide — Claude Fable 5.1 model card (context, effort, regions, caching)](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-anthropic-claude-fable-5-1.html)
- [Amazon Bedrock User Guide — Abuse detection and Enterprise Frontier Safeguards ZDR window](https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html)
- [Introducing Claude Fable 5.1 on AWS — AWS Artificial Intelligence Blog](https://aws.amazon.com/blogs/machine-learning/introducing-claude-fable-5-1-on-aws/)
- [What's New — Claude Fable 5.1 is now available on AWS](https://aws.amazon.com/about-aws/whats-new/2026/09/claude-fable-5-1-aws/)
- [Anthropic Claude Fable 5 on AWS: Mythos-class capabilities with built-in safeguards](https://aws.amazon.com/blogs/aws/anthropic-claude-fable-5-on-aws-mythos-class-capabilities-with-built-in-safeguards-now-available/)
- [DevelopersIO — Calling Claude Fable 5.1 from the Converse API (effort levels, caching gotchas)](https://dev.classmethod.jp/en/articles/bedrock-claude-fable-5-1-converse/)