A Monday morning problem: Sarah Chen manages 12 assembly lines and 2,000 machines. Before her 10 AM production review, she needs to know which lines need attention. She starts in the IoT dashboard, where Line 4's motor temperature is 12°C above baseline. The dashboard shows signals, not causes. She pivots to the ERP system for maintenance history, then to a historian database for operating hours, then to OEE trends, defect rates, and emails three supervisors. By 11:15 AM, she has an answer. Meanwhile, Line Supervisor Raj Patel works from a stale PDF export, and Maintenance Technician Priya Nair cannot access vibration data. Three people, five disconnected systems, hours of manual work—for answers that should take seconds.
The Problem: Data-Rich, Insight-Poor
The average enterprise runs five to eight operational and analytical systems daily, each with its own login and query interface. When a manager needs a cross-system view, a human becomes the integration layer. Traditional BI dashboards show what happened yesterday. Single AI assistants answer isolated questions. Neither can autonomously coordinate across the entire technology stack. Custom multi-agent frameworks require months of engineering: custom connectors, session isolation, memory infrastructure, security code, scaling logic, and orchestration. Businesses should not need an engineering team just to ask questions about their own data.
The Solution: Configuration, Not Code
Amazon Bedrock AgentCore flips the model. Instead of building an autonomous intelligence system from scratch, you configure one. Amazon Bedrock AgentCore handles orchestration, security, memory, and scaling. You bring your data sources and business rules. The result is a system where Sarah, Raj, and Priya can each ask natural language questions and get synthesized, personalized answers from across the entire technology stack—without knowing which system provided which piece of the answer. The model is three steps: Connect your existing systems using pre-built MCP server connectors—no custom integration code. Define who can see what using plain-English policy rules that Amazon Bedrock AgentCore translates into enforcement logic. Ask questions in natural language and let Amazon Bedrock AgentCore orchestrate the rest.
Architecture Overview
The architecture is organized into five layers: users at the top, Amazon Bedrock AgentCore as the center of gravity, pre-built MCP server connectors in the middle, and data infrastructure at the foundation. Every user interaction flows through Amazon Bedrock AgentCore—through authentication, policy, memory, and the Agent—before reaching data sources. The agent looks up the Semantic Layer powered by SageMaker Data Catalog to discover what data exists and where it resides, then routes the query to the appropriate pre-built MCP server connector (equipment, IoT telemetry, supply chain, analytics, or custom low-code), which pulls data from underlying infrastructure—SageMaker Lakehouse, Redshift, S3 Tables, OpenSearch, or Aurora. New sources can be on-boarded by registering them in the Data Catalog rather than writing custom integration code.
How It Works
Data Infrastructure
The data foundation is built on Amazon SageMaker Lakehouse, an open lakehouse architecture compatible with Apache Iceberg that unifies data across Amazon S3 data lakes, Amazon Redshift data warehouses, and operational data stores through zero-ETL integrations. The agent accesses this unified data through a combination of pre-built and custom MCP servers. Pre-built MCP servers include Amazon Redshift MCP server for warehouse queries, AWS S3 Tables MCP server for historical data, and Amazon Aurora PostgreSQL MCP server for operational data. Custom MCP servers can be built for services without a pre-built option, such as IoT Telemetry MCP server (queries Amazon Timestream for real-time sensor time-series), Quality Analytics MCP server (queries Amazon OpenSearch Serverless for defect pattern matching), and Semantic Layer MCP server (queries SageMaker Data Catalog metadata). Building a custom MCP server requires only defining the tool interface and delegating to the AWS SDK.
MCP Servers: Pre-built Connectors to Your Data
The Model Context Protocol (MCP) is an open standard that defines how AI agents discover and invoke tools. Each domain of your business is represented by a dedicated MCP server exposing typed tools like get_equipment_status, detect_anomaly, and check_parts_inventory. Amazon Bedrock AgentCore provides pre-built MCP connectors for common systems: Amazon Redshift, Amazon Aurora, Amazon OpenSearch, and third-party systems through OAuth. For proprietary systems, low-code MCP server templates reduce effort to configuration. Connectivity options span semantic store, relational databases, streaming services, vector stores, data warehouses and lakehouses with zero ETL, and third-party SaaS via REST or GraphQL APIs. MCP servers can run in stateless mode (default) or stateful mode for multi-step operations.
Amazon Bedrock AgentCore Gateway: Unified Entry Point and Intelligent Routing
The Gateway is the single entry point through which every agent-to-tool call flows. When a new MCP server is registered, the Gateway performs a protocol handshake and indexes its available tools. The agent calls tools by name through the Gateway, which routes the request to the appropriate server. The Gateway implements a three-tier caching strategy: organization-scoped cache for reference data, user-scoped cache for recent query results, and policy engine determines which responses can be shared.
Amazon Bedrock AgentCore Runtime: Isolated Execution for Every User
Amazon Bedrock AgentCore Runtime deploys agents to Firecracker microVM environments, delivering isolation and security with no servers to manage and automatic scaling. When Sarah submits her query, Runtime spins up a dedicated microVM. Raj's session runs in a separate microVM. Priya's in a third. No shared filesystem, memory, or networking. When the session ends, the microVM is destroyed. Multi-tenancy is a runtime attribute, not a software convention.
Amazon Bedrock AgentCore Identity: Authentication that Propagates
Amazon Bedrock AgentCore Identity integrates with existing providers (Okta, IAM, Cognito, OAuth 2.0) and propagates user context through the entire call chain using the Mcp-Session-Id header. Two flows are supported: agent-level access (service-to-service) and user-delegated access (agent acts on behalf of a specific user). In practice: Sarah's token grants access to all three plants, all 12 lines. Raj's token scopes to Plant 2, Line 7 only. Priya's token scopes to Machines 41-45. These restrictions come from the IdP and propagate automatically.
Amazon Bedrock AgentCore Policy: Authorization in Plain English
Policy in Amazon Bedrock AgentCore integrates with Gateway to intercept every tool call in real time. Teams create policies using natural language that automatically convert to Cedar—the AWS open-source policy language—with automated reasoning for completeness. Policy enforcement happens at the Gateway level, intercepting every tool call before execution. Rules operate across multiple dimensions: user role, geographic scope, data classification, time of day, and specific tool parameters. A policy might read: "Line supervisors can call get_equipment_status only for lines within their assigned plant." When Raj asks about Line 4, the Gateway evaluates his identity against this rule and returns a deny decision before the MCP server is ever called. Every decision is logged to AWS CloudTrail.
Amazon Bedrock AgentCore Memory: Context that Persists
Amazon Bedrock AgentCore Memory enables agents to learn and adapt from experiences, with support for episodic memory. Short-term memory captures turn-by-turn context within a single session. Long-term memory persists selected insights across sessions, organized into namespaces: user-scoped, team-scoped, and organization-scoped. Retrieval passes through Policy—even if an insight exists in long-term memory, it will not surface to a user who lacks access to the underlying data.
Amazon Bedrock AgentCore Registry: Governed Tool Discovery
Amazon Bedrock Agent Registry enables organizations to discover, share, and reuse agents, tools, and agent skills through a governed catalog with publish-and-approve workflows. New MCP servers enter the Registry in draft state. Administrators review and approve them. Once approved, the agent automatically discovers the new tools on the next invocation—no redeployment needed. The Registry also enables versioning.
Three Users, One System, Three Different Views
Sarah asks: "Which assembly lines need attention this week?" Amazon Bedrock AgentCore Runtime creates a microVM for Sarah's session. The Gateway authenticates her—role: Plant Manager, scope: all associated assembly lines. The agent classifies the intent as multi-source and operational. It calls the Equipment MCP Server and IoT Telemetry MCP Server in parallel. Policy evaluates each call: Sarah's role permits all of them. Memory recalls that Sarah prefers severity-ranked output. The synthesized response—a ranked list of assembly lines with supporting evidence—arrives in seconds.
Raj asks: "What's the current status of Line 7?" Raj's session runs in a separate microVM. His Okta token scopes him to Plant 2, Line 7 only. The agent routes the same tool calls—but Policy intercepts and enforces the scope restriction. Line 7 data returns. Lines outside his scope do not. The Gateway's user-scoped cache serves part of this response from Raj's recent query history, reducing latency.
Priya asks: "Has the vibration on Machine 42 gotten worse since last week?" Priya is scoped to her assigned equipment. The agent calls the IoT Telemetry MCP Server with machine_id=42 and metric=vibration. Policy confirms Machine 42 is in Priya's assignment list. Amazon Bedrock AgentCore Memory surfaces a summary from her session last week, enabling a week-over-week comparison without Priya having to specify the timeframe. The response includes the trend, the delta, and a maintenance recommendation.
Throughout all three interactions: three isolated microVMs, three distinct policy evaluations, three personalized memory contexts. Users cannot see each other's data. No configuration was needed to achieve this separation—it is the default behavior of the system.
What Makes This Architecture Different
- Configuration is the interface for the business. A business analyst can define a new access policy in plain English. A data engineer can register a new MCP connector through the Registry UI. Neither requires changes to the orchestration layer or a deployment cycle.
- The MCP open standard helps prevent lock-in. MCP-compatible tools or services can be registered with Amazon Bedrock AgentCore, including open-source connectors, third-party integrations, and future AWS-native services.
- The Registry compounds growth. Adding a new MCP server connector does not require changes to the agent, updates to routing logic, or redeployment of existing components. Each new connector increases the system's intelligence automatically.
- The system gets smarter over time. Amazon Bedrock AgentCore Memory accumulates user preferences, recurring patterns, and session summaries. Combined with Gateway caching, response times improve as the system learns.
- Security is a design principle, not an afterthought. Data isolation is enforced at the infrastructure layer—by the microVM boundary and by the Policy engine intercepting every tool call. A misconfigured agent cannot accidentally return data it should not.
Looking Ahead: Extensibility
The Agent-to-Agent (A2A) protocol will allow Amazon Bedrock AgentCore agents to collaborate with agents running on other infrastructure or in other organizations. Multi-modal interaction, such as a voice interface on the factory floor, connects to the same Amazon Bedrock AgentCore backend. Proactive agents extend the model beyond query-response, monitoring incoming IoT data continuously and surfacing alerts when thresholds are crossed.
Summary
It is now 9:58 AM on that same Monday. Sarah types a question into the chat interface: "Which assembly lines need attention this week?" By 10:00 AM, she has a ranked list with root-cause context drawn from equipment records, live sensor data, and maintenance history. The production review starts on time. Raj gets his Line 7 status in the same session, without visibility into Sarah's view. Priya gets her Machine 42 trend comparison, with the memory of last week's baseline already loaded. Amazon Bedrock AgentCore—through the combination of MCP server connectors, Runtime isolation, Gateway routing, Identity propagation, Policy enforcement, Memory persistence, and Registry governance—makes this possible as a configured system rather than a custom-built one. The business describes what it wants. The system handles how it works.
Images
