How AgentFlo built AI sales agents with Amazon Bedrock AgentCore – Part 2

Summary

AgentFlo designed an architecture using Amazon Bedrock AgentCore and AWS serverless infrastructure to address traffic spikes and build trust in autonomous commerce agents. Security operates across three stages: AWS Fargate filters prompt injections and opt-outs, AgentCore Gateway enforces deterministic Cedar authorization policies during tool execution, and post-turn privacy filters screen outputs. Session isolation is maintained across merchants through AgentCore runtime microVMs, while AgentCore Observability and Amazon CloudWatch provide end-to-end tracing. Data reliability and long conversation journeys rely on Amazon DynamoDB context storage, Amazon Bedrock Knowledge Bases, and Amazon S3 Vector embeddings. Early deployment data showed a 12 percent net revenue uplift.

Context

Enterprise customers will not deploy autonomous commerce agents that expose sensitive data, hallucinate prices, offer unauthorized discounts, or forget context across extended multi-turn customer sales journeys.

Approach / What changed

AgentFlo built a multi-layered defense and data foundation using AWS Fargate for ingress filtering, Amazon Bedrock AgentCore for microVM session isolation, deterministic Cedar policies at the AgentCore Gateway, and Amazon DynamoDB for stateful conversation context.

Takeaways

• Deterministic Cedar policies at the AgentCore Gateway enforce business rules like discount limits independently of model reasoning.
• AgentCore runtime microVMs provide complete session isolation between merchant agent interactions.
• Pre-turn AWS Fargate filters, mid-turn AgentCore Gateway policies, and post-turn output filters combine to form a three-layer security model.

Related reading

• AWS · Aug 26, 2026

  Closing the AI agent trust gap with graduated autonomy

  Operating AI agents under binary full-access or read-only permissions creates an operational trust gap due to unpredictable model behavior across updates. The graduated autonomy architectural pattern closes this gap by dynamically granting or revoking tool permissions through sustained reliability scoring. A scoring engine computes a composite score across five weighted dimensions over a rolling 50-action window, mapping agents across four tiers from probation to full autonomy. In-process pre-execution filters check for prompt injection and sensitive targets, while Amazon Bedrock AgentCore Gateway and Cedar policies strictly enforce deny-by-default access at the infrastructure level. Post-execution state capture in Amazon DynamoDB supports reversibility, and AWS CodePipeline delivery gates block releases failing adversarial evaluation benchmarks.

  Dev Arora

• Grab · Jul 24, 2026

  Agent platform (Part 1): How we help Grab build and run AI agents at scale