Field note · AWS agent platform · July 2026
Amazon Bedrock AgentCore: the production agent platform map
Amazon Bedrock supplies foundation models. AgentCore supplies the modular operating layer that hosts, connects, secures, evaluates and improves agents in production.
Managed agent loop or full orchestration control.
Serverless, isolated sessions for agents and tools.
Govern tools, agents, models and delegated credentials.
Trace, measure and improve production behaviour.
Amazon Bedrock and AgentCore solve different layers
Amazon Bedrock gives applications governed access to foundation models, model evaluation, Guardrails, Knowledge Bases and Data Automation. Amazon Bedrock AgentCore is the surrounding agent platform. It can host framework-based agents, expose tools, manage identity and memory, apply deterministic tool policy, observe traces and evaluate behaviour.
This distinction matters. A model is not a runtime, a runtime is not a workflow engine, and an MCP endpoint is not an authorization model. Production architecture names each responsibility explicitly.
Choose Harness or Runtime deliberately
AgentCore Harness provides a managed agent loop. You define a model, system prompt and tools, and the service handles reasoning, tool execution, memory integration and response streaming inside an isolated microVM. It is the faster path for deep research, coding and data-analysis agents.
AgentCore Runtime is the lower-level serverless hosting environment. You bring the agent code and orchestration loop, package it as a container and retain control over framework, state and tool sequencing. Use Runtime for LangGraph, Strands, CrewAI, Google ADK, OpenAI Agents SDK or a custom graph when the orchestration is part of the product.
Gateway is the agent traffic boundary
AgentCore Gateway is broader than an MCP adapter. It can turn OpenAPI, Smithy and Lambda targets into MCP tools, front existing MCP servers, pass through A2A agent traffic and route inference across model providers from one governed endpoint.
Place Gateway between the agent and business capabilities. Give every operation a typed schema, owner, side-effect classification and policy context. Do not expose a broad application credential simply because the model can call a tool.
Separate identity from model reasoning
AgentCore Identity gives agents stable workload identities and manages access to AWS and third-party systems using IAM, OAuth and external credential providers. Credentials remain outside prompts and memory.
AgentCore Policy integrates with Gateway and can intercept tool calls before execution. Rules can be authored in Cedar or from natural language, but the final decision is deterministic. The model proposes an action; policy decides whether the tool call is allowed.
Use memory, RAG and operational state for different jobs
AgentCore Memory supports short-term conversation context and long-term memories that persist across sessions. Bedrock Managed Knowledge Bases provide enterprise RAG, native connectors, ACL-aware retrieval, Smart Parsing and agentic multi-hop retrieval.
Neither should replace an authoritative database or durable workflow state. Memory personalizes and recalls. Knowledge Bases ground answers in enterprise evidence. Transaction systems and workflow engines remain the source of truth.
Browser and Code Interpreter need isolated sessions
AgentCore Browser provides isolated browser sessions with live viewing, CloudTrail logging and replay. AgentCore Code Interpreter runs Python, JavaScript and TypeScript in managed sandboxes.
These tools expand what an agent can do, but they also expand the attack surface. Restrict network destinations, session duration, files, credentials and tool policy. Treat generated code and browser actions as untrusted until validated.
AgentOps requires traces, evaluations and controlled improvement
AgentCore Observability uses CloudWatch and OpenTelemetry-compatible traces to expose model, tool and agent activity. AgentCore Evaluations can assess sessions, traces and spans before release and against production samples. Optimization uses evaluation signals and controlled experiments to improve prompts and tool descriptions.
Registry adds governed discovery for agents, tools, MCP servers, skills and custom resources. Together these capabilities turn an agent from an isolated application into an operable platform asset.
A production reference architecture
- ExperienceAPI Gateway or application channel authenticates the caller and attaches tenant, user and purpose context.
- ReasoningAmazon Bedrock model inference runs inside an AgentCore Harness or custom agent hosted on Runtime.
- CapabilitiesGateway exposes narrow MCP, HTTP and A2A targets. Identity supplies scoped credentials and Policy authorizes each action.
- KnowledgeManaged Knowledge Bases and Memory provide evidence and continuity without replacing systems of record.
- ExecutionStep Functions, Temporal-style workflows, EventBridge, SQS or application services own durable state and recovery.
- AssuranceGuardrails, CloudWatch, OpenTelemetry, Evaluations, CloudTrail and release evidence measure quality and risk.
When AgentCore is the right fit
Use AgentCore when you need framework and model flexibility but still want AWS-managed agent runtime, tool governance, identity, memory, sandboxed compute, observability and evaluation. Use individual AgentCore services independently when your agent already runs on ECS, EKS, Lambda or on premises.
Do not introduce every module on day one. Start with the smallest vertical slice that proves identity, one bounded tool, one evidence path and one evaluation gate.
Executive takeaway
The production value of AgentCore is not that it adds another agent framework. It separates runtime, tools, identity, policy, memory, evidence and improvement into explicit services that can be governed independently.