With governance ceiling (SCP), baseline automation (Control Tower), and evidence collection (Audit Manager) in place, what remains is day-to-day operations. Applying firewall policies consistently across hundreds of accounts, controlling tags and costs, and automatically activating security tools every time a new account is born — this is the operations plane. Today's focus: AWS Firewall Manager (central firewall policy distribution), tag/cost governance, and security baseline automation.