One secure question.
A connected enterprise.
Building a governed AI assistant that unlocks data, diagnostics and operational knowledge across fragmented enterprise systems—using Amazon Bedrock, secure MCP tools and reusable agent capabilities.
- Business problem
- Business users depended on specialists to assemble evidence across disconnected enterprise systems.
- Architectural approach
- The study sets out an architectural approach for permission-aware investigation across approved data and tools.
- What this demonstrates
- Illustrative architecture and recommendations for governed self-service investigation; no measured savings or production performance are claimed.
Turn inaccessible information into governed operational intelligence.
Business-system screens, operational logs and data-platform outputs held valuable evidence, but answering even routine questions often depended on administrators, engineers and super users. Multi-platform enquiries involved manual extracts and specialist interpretation; some users did not know that relevant data existed.
The response was a Bedrock-powered, natural-language assistant connected to secure Model Context Protocol (MCP) services. Two user experiences—an accessible internal chat interface and an extensible power-user agent harness—shared a reusable integration layer. Observed demand guided the development of new tools, agent skills and orchestrated workflows.
Data was collected everywhere. Answers were accessible to very few.
The constraint was not simply the absence of dashboards. It was the inability to traverse fragmented operational context safely, quickly and without specialist intervention.
Interfaces ≠ interoperability
Individual applications exposed useful information, but combining quality, product and finance evidence required manual navigation and reconciliation.
Critical logs out of reach
Process and system logs, often essential to root-cause analysis, lacked business-friendly interfaces or consistent pathways into the data warehouse.
Expert dependency
Administrators, engineers and super users acted as human query engines, adding queues and context-switching to otherwise routine diagnostic work.
Invisible information assets
Users could not ask about telemetry they did not know existed. Weak discoverability suppressed demand for insights as well as access to them.
How can operations, finance and product teams ask joined-up questions across live enterprise systems without granting a language model unrestricted data or system access?
Two access paths. One governed agent platform.
Different user groups need different interfaces—not different security standards. Both experiences share the same approved tools, identity model and observability pipeline.
Internal conversational workspace
A familiar chat-style interface, backed by AWS SDK / AgentCore SDK integration: corporate sign-in, secure session handling, permission-aware tool use and answers linked to evidence.
Reviewable findings assembled from permitted operational sources, with explicit coverage and freshness.
Open agent harness + MCP catalogue
Engineers and advanced analysts use an approved open-source agent SDK or harness—such as Strands Agents—and discover versioned MCP capabilities through a governed tool catalogue.
# Illustrative Strands pattern
agent = Agent(
model=BedrockModel(),
tools=approved_mcp_tools
)
answer = agent(
"Explain failed ETL validations"
)Deployment choice: the in-house workspace can call an agent hosted in AgentCore Runtime. A power-user harness can instead execute locally using federated credentials and the same approved MCP Gateway. Either route must preserve the same policy enforcement and source-side entitlements.
Federate intelligence—not unrestricted privileges.
The assistant acts as an evidence orchestration layer. Existing systems remain systems of record; access to their APIs, logs, warehouses and documents is mediated through purpose-built, contract-driven tools.
Build typed, reusable domain tools with bounded parameters, field filtering, stable contracts and clear owners.
Where there is no user-facing API, use controlled Lambda or service adapters over authorised back-end interfaces.
The agent retrieves live evidence from systems of record; the enterprise warehouse complements it but is not a prerequisite.
From a question to a traceable answer.
A good agent does not simply generate fluent prose. It selects permitted capabilities, gathers structured evidence, reconciles conflicting signals and states what it cannot establish.
- 01Authenticate and scopeIDENTITY
Map the SSO identity to entitlements, operating region and allowed source systems. No shared administrator credentials.
- 02Plan an evidence routePLANNING
Select the minimum approved tool set: validation outcomes, time-bounded logs, downstream processing status.
- 03Authorise each tool callPOLICY
Evaluate tool-level policy, input schema, time-window limits and source permissions before execution.
- 04Join, check and attributeEVIDENCE
Correlate authorised results, preserve source identifiers and timestamps, expose coverage gaps and conflicts.
- 05Respond with confidence boundariesRESPONSE
Return an actionable summary with provenance, limitations and safe next steps—or escalate rather than invent missing facts.
Every material statement should have a way back to evidence.
Use a structured evidence envelope per claim: system, record or query identifier, time of retrieval, policy outcome and a retrievable reference. Show “not available” when a source is outside the user's entitlement or is stale.
Trust is engineered into tool execution—not delegated to a prompt.
The most important design work takes place outside the foundation model. These controls prevent helpful natural-language access from becoming an unchecked path into sensitive operational infrastructure.
Identity-bound authorisation
Federated SSO, least-privilege tool policy and backend row/column or record-level checks. Access denied at the tool or data source remains denied in chat.
Governed MCP contracts
Versioned schemas, tool ownership, parameter bounds, pagination, timeouts and allowlisted destinations. A tool registry is a controlled product—not a plugin free-for-all.
Untrusted content boundaries
Documents and log lines are evidence, never instructions. Isolate retrieved content from system directives and test prompt-injection and tool-output manipulation.
Privacy & provenance
Minimise, redact and classify results before model use. Keep sensitive payloads out of unprotected traces; attach citations, freshness and lineage to responses.
Read first, act by exception
Start with read-only diagnostics. Any future write or workflow-changing tool requires dedicated permissions, risk controls and explicit human approval.
Reliability & cost guardrails
Use query limits, circuit breakers, retry discipline, model budgets and latency targets. Return partial evidence with warnings when a source is unavailable.
A guardrail can inspect language, but it is not an access-control system. Authorisation must be deterministic, enforced at the tool boundary and—where needed—rechecked by the underlying source.
Use managed primitives where they reduce undifferentiated risk.
The right AWS choices separate reasoning, execution, identity, policy, integration and assurance. Components below are proposed implementation options, to be selected according to available Region, connectivity and platform standards.
Managed foundation-model inference; policy-configured filtering for unsafe content and sensitive data. Good practice: select models against evaluated tasks and apply guardrails at defined input/output boundaries.
Managed runtime for Strands or other agent frameworks with per-session isolation. Good practice: keep execution controlled, monitor runtime costs and use private connectivity where needed.
Exposes approved Lambda, API or MCP capabilities behind a consistent interface. Good practice: restrict target registration, schemas and tool availability rather than exposing arbitrary enterprise endpoints.
Credential and workload-identity management with fine-grained policy evaluation for MCP tool calls. Good practice: default deny, least privilege and source-side entitlement checks.
Captures tool execution paths, errors, latency and usage for operational diagnosis. Good practice: trace decisions without indiscriminately recording user prompts or sensitive source contents.
Supports short- and long-term agent context where the use case needs it. Good practice: isolate users, define retention and consent, and exclude sensitive logs or privileged records from persistent memory.
Automated assessments against response quality and tool behaviours, with custom checks where required. Good practice: run curated test sets before release and monitor performance on sampled production traces.
Retrieves indexed guidance and documents with references. Good practice: apply document entitlements and freshness controls; use live MCP tools when current transaction or log state is required.
Framework choice: the open-source Strands Agents SDK provides a code-first harness; Amazon Bedrock Agents is a managed orchestration alternative. They are not mandatory layers to deploy simultaneously. AgentCore services can support either architecture where compatible.
AWS capability references: RuntimeGatewayPolicyObservabilityEvaluations
Turn repeated questions into reusable enterprise capabilities.
The assistant is also a discovery mechanism for unmet data demand. A managed product loop captures recurring intents, promotes stable patterns into reusable components and evaluates every meaningful change before release.
Quality-event lookup
Read a bounded set of failures and validation outcomes by process, interval and permitted scope.
Typed API + permissions + testsOperational triage
Consistent evidence checklist for tracing failed processing steps across logs and quality events.
Instructions + required sources + evalsCross-platform impact
Correlate processing lineage, product status and downstream finance effects without ad hoc manual joining.
Orchestration + failure semanticsNew skills and MCP tools require a named owner, access classification, contract tests, security review, evaluation dataset and rollback path before promotion to production.
Measure solved work—not chat volume.
Adoption metrics alone can reward shallow answers. A mature programme balances end-user outcomes with factual quality, security, service reliability and cost per completed enquiry.
Time to verified insight
Time from question submission to a cited, usable response—not merely first token latency.
Self-service resolution rate
Eligible enquiries resolved without specialist escalation ÷ all eligible enquiries.
Evidence coverage
Share of sampled material claims supported by inspectable, authorised source references.
Tool & workflow health
p95 latency, timeouts, source errors and completion rate for critical investigation paths.
Access control outcomes
Unauthorized disclosure: zero-tolerance objective; test denial and escalation paths explicitly.
Cost per resolved case
Model, agent, tool and retrieval costs divided by verified resolved enquiries.
Baseline first, then targets. Establish a manual-resolution baseline and representative question set; record both successful and failed interactions.
Make intelligence self-service—and operational capability reusable.
Information outside familiar application screens becomes discoverable through natural-language enquiry.
Cross-platform investigations no longer depend entirely on manually assembled extracts.
Operations, finance and product users can ask questions directly within their approved entitlements.
Recurring requests inform new domain tools, agent skills and reusable agent workflows.
What expert AWS solution architecture adds.
The highest-value decision is not which model to use. It is how to turn fragmented enterprise capability into secure, testable, reusable products with measurable user value and defensible controls.
- Start with real investigation journeys and source-system constraints—not a chatbot demonstration.
- Build the entitlement and tool-contract model before scaling agent autonomy.
- Separate managed AWS primitives from reusable business-domain logic.
- Ship quality gates, observability and an evidence feedback loop as part of the product.
