AgentCore, deployed the way it survives review
An agent that works in the console is not an agent that survives a security review. Typed action groups, guardrails tuned per group, memory with an actual schema, tracing end to end, three environments as code — inside your own AWS account.
5 days
from kickoff to a first live agent in your account
<200ms
p95 routing overhead, model inference excluded
7
build stages, each signed off before the next
Five ways an AgentCore project stalls
None of these are model problems, and all of them show up after the demo has already been approved.
The prototype-to-production gap
AgentCore demos work in a notebook; nothing is wired for production. No infrastructure as code, no environments, no observability, no rollback path — every change is a hand-edit in the console.
Guardrails missing or miscalibrated
Denied topics, sensitive-data filters and grounding checks were never tuned per action group, so agents either leak what they should not or refuse legitimate requests.
No production observability
No traces across the gateway, the agent and the action-group functions. Latency spikes are invisible, and a tool-call failure looks like a model failure.
Memory designed by accident
Session state stuffed into a single blob with no long-term schema, keys shared across tenants, and no path from a session fact to a durable one.
The wrong network topology
Agent traffic leaves the customer's network over public endpoints, and the security review rejects the architecture because private endpoints were never deployed.
Seven stages, in this order
Topology before configuration, guardrails before traffic, and the network design agreed with your platform team before anything is deployed.
Requirements and agent topology
Map intents, tool boundaries and trust zones. Decide supervisor versus flat graph, which models route to which action groups, and where a human sits in the loop.
AgentCore configuration
Action groups implemented as typed function handlers with schema'd tool contracts, and knowledge bases provisioned with the embedding model chosen for the corpus.
Guardrails
Denied topics, sensitive-information filters, content policies at calibrated thresholds, and contextual grounding checks tied to the knowledge base — configured per action group, not once globally.
Memory
Short-term state with conversation-scoped partitioning and expiry, plus a separate long-term store for durable facts, with customer-managed keys per tenant.
Observability
Dashboards per agent and per action group, end-to-end tracing through the gateway, the agent, the functions and retrieval, so a slow request can be attributed.
Multi-environment IaC
Development, staging and production shipped as CDK or Terraform stacks, with pipelines for function deploys, knowledge-base re-ingestion and guardrail changes.
Deployment in your account
Deployed into your own AWS account behind private endpoints, with least-privilege roles, permission boundaries and audit logging to an account you control.
Six things the console will not give you
Agent topology and action groups
The agent graph designed first — supervisor, specialists and tool boundaries — then implemented as action groups backed by typed functions.
Guardrails tuned per group
Because a research agent and a transaction agent need different thresholds, and a single global policy makes one of them useless.
Memory with a schema
Short-term and long-term stores with explicit lifetimes, partitioning that avoids contention, and per-tenant keys.
Full observability stack
Dashboards, distributed traces and structured logs, so an SLO conversation is about data rather than screenshots.
Multi-environment IaC
Three environments, real pipelines, and a rollback path that has been tested rather than assumed.
Customer-VPC topology
All traffic on private endpoints, least-privilege roles with permission boundaries, and audit logging that satisfies the review before it starts.
Your account, your keys, your code
Nothing about this deployment requires you to depend on us afterwards.
It runs in your AWS account behind your own private endpoints, on least-privilege roles your platform team approves, with the infrastructure defined in code you keep. If you take it in-house in month four, everything you need is already in your repository — which is the only version of this arrangement that is fair to the buyer.
Five situations where the topology is the requirement
Financial services
Internal advisor copilots, onboarding triage and policy-aware research agents, all inside the bank's own AWS account.
A supervisor agent routing to portfolio, compliance and document specialists, each with its own guardrail profile.
Healthcare and life sciences
Deployments for clinical summarisation and drafting, on covered services with sensitive-data filters at the tool boundary.
A note summariser with redaction guardrails, grounded against the customer's own approved corpus.
Government and regulated public sector
Architectures targeting the stricter cloud postures: private endpoints for every service, permission boundaries, audit logs to a separate account.
A citizen-services agent with denied-topics guardrails for off-mission queries and grounding to vetted policy documents.
AWS-committed enterprises
Companies with existing AWS commitments that want internal AI to spend against that contract and run on the identity and monitoring their team already knows.
An internal engineering copilot calling action groups for the issue tracker, the wiki and the code host.
Regulated SaaS platforms
Vendors deploying per-tenant stacks for customers who require AI inside their own network, each with its own keys.
A per-tenant document agent provisioned by a pipeline triggered from the customer onboarding workflow.
Live in five days, hardened by week four
The five-day milestone is a real agent in your account, not a slide. It exists so the security conversation happens against something concrete.
Days 1–2
Discovery and architecture
Intents, action-group boundaries and trust zones mapped. Models chosen per task. Security topology signed off with your platform team before anything is built.
Days 3–5
The five-day MVP
AgentCore configured, baseline guardrails active, knowledge base live, memory running, dashboards up — deployed into your own account, not ours.
Weeks 2–3
Production hardening
Tracing end to end, guardrails calibrated per group, the long-term memory schema, private endpoints and customer-managed keys.
Week 4
IaC and hand-off
Three environments as code, pipelines, rollback runbooks, alarms and an on-call playbook. You own the code, the keys and the account.
Bring your platform team to the first call
This is our AI engineering practice
It is real work and it is where our four products came from. But what Cognilium leads with is narrower: optimization apps that run in tandem with Microsoft Dynamics 365, computing the decisions the ERP records but does not derive — the optimal price, the optimal pick path, the optimal stock level. See the optimization apps · How we build inside the ERP.