Trust model & invariantsThe security posture is structural, not prompt-based. These invariants are enforced by code and guarded by tests.
| Invariant | Enforcement |
|---|
| Verdicts from Lambda gates only | Gates parse exit codes and logs; no model SDK is importable (gates/requirements-gates.txt = jsonschema + referencing) |
| Verdict isolation | No LLM output feeds any Choice routing variable |
| Gate determinism | Same input → same output. No randomness, no model calls |
| Per-agent IAM | 13 scoped roles; none can invoke another agent (InvokeAgentRuntime on no role) |
| Bounded fix loops | State-machine counter; escalates at max |
| Fix validation | Schema and compile check before re-entry to an expensive stage |
| Exactly-one signal | Each agent calls exactly one SendTaskSuccess/SendTaskFailure |
| Workspace jail | All I/O confined to runs/<id>/; .. rejected |
| Mock honesty | Mock results carry backend:"mock" and never influence a verdict |
| No design-IP egress | All compute, storage, inference stay in the customer AWS account |
Guardrails. A Bedrock Guardrail is deployed
advisory on POC (id
qj11zn3wdqet). Enforcement mode fails closed; advisory mode fails open and records the intervention rate. Agent-side guardrail code is wired at three model choke points but the infra toggle is still being rolled through — see the
status page.
Per-agent least privilege13 dedicated roles, each holding exactly what its stage needs. If any agent is compromised, its blast radius is its own scope.
Scoped by design
design/testbench/signoff — bedrock:InvokeModel, S3 R/W on runs/*verification — model (formal harness) + S3; lint & formal on one runtimesimulate/pnr — S3 + ssm:SendCommand (tag-conditioned) for PCSregistry — DynamoDB PutItem/GetItem onlynotifier — ses:SendEmail, sns:Publishcleanup — destructive actions gated by ALLOW_CLEANUP + resource tags
Verified sound in the review
- No
shell=True, os.system, or eval anywhere — the fixed-argv rule holds
- Cognito M2M secret never reaches a CFN parameter, SSM, or env var — Secrets Manager only
- No
0.0.0.0/0 ingress in any template
- Gate & invoker Lambda roles genuinely minimal
- Adapter path sanitisers (
option_safe_path, workspace jail) are well-built allowlists
Well-Architected reviewConducted 2026-08-04 at commit bac666b, covering all five pillars. Method: read from templates and source — no live account state was inspected, so dollar figures are order-of-magnitude.
Sustainability was not assessed. Each finding was graded real now, latent (correct today, breaks on a plausible change), or a disclosed POC tradeoff (the code already names the compromise). Items confirmed sound were recorded too.
Headline findings by pillar
| Pillar | Most significant finding at review time | Grade | Now |
|---|
| Security | S2 — agents could overwrite Lambda deployment packages (bucket-wide PutObject); deferred code injection on next deploy | Real | Scoped to runs/* |
| Security | S1 — a role granted InvokeAgentRuntime, contradicting a stated invariant | Real | Role deleted |
| Security | S5 — gate evidence not bound to the run under audit (verdict integrity) | Real | Guard + run_id bound |
| Cost | C1 — documented idle cost off by ~17× (POC ~$25/mo, not ~$5) | Real | Corrected |
| Cost | C6 — nothing expired: no log retention, no lifecycle on run data | Real | 13 groups + 6 rules |
| Cost | C9 — fix budget was per-stage, so "5" meant up to 20 | Real | Run-wide total |
| Performance | P1 — HeartbeatSeconds == TimeoutSeconds on all 13 states; liveness bought zero early detection | Real | 120–180s, verified live |
| Performance | P2 — strictly sequential DAG; ~35–110s of free latency in two independent pairs | Real | Deferred |
| Reliability | R1 — failure path recorded nothing, told nobody | Real | RegisterFailure→NotifyFailure |
| Op. Excellence | O3 — EnableAlarms had four defaults; effective default OFF | Real | All true, 22 alarms |
The review credited what was sound. A review that lists only defects gives a false picture: fixed-argv discipline held everywhere, the Cognito secret was handled correctly, ECR lifecycle policies were separated so the app rule can't expire a referenced base, and the token price table's unknown-model fallback is deliberately nonzero so a silent $0 can't understate spend.
AgentCore Agentic AI Lens reviewA second, distinct review — a gap analysis of the agentic layer against the AWS Well-Architected Agentic AI Lens, AgentCore best practices, and multi-agent collaboration guidance. Advisory, not a scored pass/fail.
Reviewer stance: "this is a mature system — the orchestration and trust model are excellent and already Lens-aligned." Seven findings, each mapped to a Lens best-practice ID and prioritised. Both open P0s have since been addressed in code (see the status page); the rest track to named specs.
| # | Finding | Priority | Now |
|---|
| F2 | Live path invoked AgentCore Runtime without a runtimeSessionId (AGENTSEC05-BP02) — one run's 13 stages landed in 13 unrelated sessions | P0 | Code-complete |
| F1 | No Bedrock Guardrails on any model invocation (AGENTSEC04/08-BP01) | P0 | Advisory on POC |
| F4 | OTEL is a dependency but emits nothing (AGENTOPS05-BP01) | P1 | Specced, on integration |
| F3 | Memory used records API, not an event-based strategy; poisoning unmitigated | P1 | Code-complete, unwired |
| F5 | Agent-level eval specced but not executed (agents-eval-harness) | P2 | Not built |
| F7 | Human-in-the-loop config-gated OFF, not standardized | P2 | Spec only |
| F6 | AgentCore Gateway/MCP is intent, not implementation | Backlog | Not wired |
The review's one hard constraint: "Do not move any verdict or routing decision into a model." Three specs were proposed from it —
agents-runtime-session-identity,
agents-bedrock-guardrails,
agents-memory-strategy-upgrade — all now code-complete (see the
spec inventory).
29 open questions posed to AWS
A separate Lighthouse-POC validation ask (docs/AWS-FOLLOWUP-QUESTIONS.md) puts 29 questions to AWS across four areas — AgentCore platform maturity/roadmap, architecture & spec validation, a production-readiness bar, and program/GTM. These are open, unanswered questions to AWS, tracked for a working session with the AgentCore service team; none carry recorded answers yet.
How to read all of this honestly. The 5-pillar review was a static reading of the repo, not a live-account audit. The Agentic AI Lens review is a gap analysis with (now-addressed) open P0 items, not a clean bill. The 29 AWS questions are unresolved. None of it should be represented as a passed AWS Well-Architected Review — it is the review discipline applied to the system, with the gaps named.
Deployment & cost modelThree presets, one config file per environment. An exported shell variable overrides the file.
| Preset | What it adds | Idle floor | What dominates idle |
|---|
| poc | in-image EDA, S3 workspace | ~$25/mo | QuickSight Enterprise author (~$24). ENABLE_QUICKSIGHT=false → single digits |
| dev | + PCS/Slurm + FSx Lustre + X-Ray | ~$420–640/mo | FSx Lustre 1.2 TiB min (~$174), always-on t4g.medium login node (~$25), PCS cluster-hour fee |
| prod | + SES completion emails | ~$420–640/mo | Same as dev |
Two cost caveats, stated plainly
- The POC figure was once published as ~$5/mo — wrong by ~17×. Corrected inline in
config.poc.env.
- The QuickSight account subscription survives stack deletion —
cfn delete does not stop that charge.
- The PCS cluster-hour rate was not verifiable from the repo and may dominate the dev/prod floor — confirm against current pricing.
Per-run cost, read back from the run's own rows
- calc4 clean: ~$0.67–2 (Sonnet-on-all vs Haiku-on-non-RTL)
- AES-128: ~$1.4–5.3 (mean $2.88, driven by repair count)
- When there is nothing to report it returns
records=0, never a fabricated $0.00
- AgentCore runtimes (13, idle): $0
Note on this page's own exposure. These pages surface operational metrics — run IDs, per-run cost, token counts, model IDs, pass/fail, and the config matrix. That is intentional for a demo audience, but worth knowing before the site is made public.