AWS blueprint: an agent platform where failed denial tests fail the build

AWS published a post on 28 October 2026 on its Machine Learning Blog, written by three AWS solutions architects, describing an enterprise "Agentic AI Platform" built on Amazon Bedrock AgentCore, with an open-source reference blueprint on GitHub. It is vendor-published and promotes AWS services. It reports no customer deployment, cost or failure data. What it offers is a worked design for the part AWS says is the real blocker: not the model or the tool calls, but everything around them.

The design: a hub and isolated cells

AWS says it sees three operating models: centralised (one AI team builds everything and becomes a bottleneck), decentralised (fast, but controls drift and cost is invisible) and federated. The blueprint implements the federated one. A central Platform team owns templates, policies, approved models and guardrails. Each product or domain team gets a "Workstream cell": its own account boundary with an AgentCore Runtime, actor-scoped Memory and a tool gateway that exposes only approved tool targets.

Because each cell holds its own instances, AWS says a failure or rollback stays inside one team's boundary. Workstream teams change production only by pull request through a pipeline; direct deployment into their accounts is outside the supported model.

The part worth copying: the release gate

AWS describes a promotion sequence that runs the deployed agent, not just the code. The gate measures regression, quality, tool success, refusal behaviour, first-token latency and cost. It then pairs each authorised call with a denied one:

• Model access: an approved model call must succeed and a call to an unapproved model or Region must be refused.
• Tool access: a subscribed tool must work and a tool outside the agent's subscription must fail with the expected error.
• Identity: a request from another team's account or identity must be rejected.
• Release and retirement: the previous runtime version must be restorable, and teardown must leave no residual resources.

If an expected denial is missing, AWS says the build fails; a person then reviews the evidence before production. AWS adds that a mutation test confirms the intended control, not some other rule, caused each denial.

Controls and cost attribution

All inference passes through a shared gateway that applies guardrails, a model allow-list, per-team rate limits, token quotas and budgets. Tools are reached through a separate authenticated gateway using Model Context Protocol (MCP), the open standard for connecting agents to tools, with Cedar policies for authorisation. Cost is attributed through standard tags and AWS Cost and Usage Report reconciliation, so finance can charge back by team, and AWS says the agent has no permission to rewrite its own attribution.

What the post leaves out

The blueprint is tested in eu-west-1 (Ireland). AWS says another Region, a substituted component or a wider rollout needs its own availability, security, load and rollback evidence. The post gives no setup time, running cost or team size. Its advice is to deploy one representative cell, prove onboarding, promotion, rollback, observability and zero-residual retirement, and only then repeat the baseline.