Amazon Bedrock AgentCore

1. Introduction

1.1. Platform Positioning

Amazon Bedrock AgentCore (hereinafter "AgentCore") is a "production-grade AI agent platform" launched by Amazon Web Services (AWS), officially described as "The platform for production AI agents. Any framework. Any model. Secure at scale." Its core proposition is: building an Agent is fast, but integrating it into enterprise systems, securing tool calls, debugging anomalous behavior, and scaling without refactoring are the real engineering burden — AgentCore productizes this burden.

Compared with existing platforms in this group, what distinguishes AgentCore is that it does not offer "yet another Agent framework" but rather a managed multi-tenant Harness runtime — developers can bring any framework (LangChain, LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, Strands SDK) and any model, while the platform handles execution isolation, tool gateway, memory, identity, policy, observability, and evaluation. This makes it the representative of the "cloud-vendor Runtime type" lineage in this group: Harness does not belong to any single model vendor but is sold independently as a cloud infrastructure layer.

1.2. Basic Information Card

1.3. Development Timeline

1.4. Position within the AI Harness System

By the parameter card's boundary definitions, AgentCore is a hybrid of an Agent Platform and an Agent Runtime: it is neither a pure framework (no restrictions on orchestration style) nor a vertical product (it does not hide the Harness mechanism), but rather exposes the six Harness layers as independently purchasable cloud components. This form has no counterpart among the existing 14 documents — Claude Agent SDK / OpenAI Agents SDK are bound to their own models, and Bailian is bound to Qwen and Alibaba Cloud, while AgentCore explicitly advocates "decoupling models from frameworks".

Another important coordinate: AWS's own coding agent Kiro is AgentCore's "super user" — Kiro is the IDE for writing Agents, and AgentCore is the platform for running Agents; together they form AWS's "develop-run" closed loop (cross-referencing the existing 12-kiro.md within this group).

2. Glossary

3. Feature Description

3.1. The Seven Components

3.2. AgentCore Harness

The Harness that went GA in 2026-06 marks AgentCore's shift from a "component supermarket" toward a "productized wrapper":

1. The minimalist surface of two APIs: CreateHarness (create: assembles model, tool, skill, and instruction configuration) + InvokeHarness (invoke: runs a session);
2. Configuration as definition: models, tools, skills, and instructions are all declared via configuration, with no orchestration code written;
3. Harness decoupled from models: supports switching models mid-session — an extremely rare capability among the 21 platforms in this group, allowing migration without interrupting the session during a model failure or for cost reasons;
4. Relationship with the seven components: Harness is a "configurational wrapper" on top of the seven components, with the underlying layers still handled by Runtime / Memory / Policy, etc.

3.3. Three-Tier Knowledge System

The paid knowledge tier goes beyond conventional RAG scope: it provides the prototype infrastructure for the "Agent economy" — content providers can charge for Agents' consumption behavior, a design unique in this group.

3.4. Framework and Model Ecosystem

• Framework side: officially compatible with LangChain, LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, Strands SDK, and self-developed frameworks, emphasizing that "the same code that runs on a laptop can be deployed to production directly";
• Model side: integrates multiple model vendors via Bedrock, and Harness supports switching mid-session;
• Kiro closed loop: Agents developed in Kiro (AWS coding agent IDE) can be deployed directly to run on AgentCore, forming AWS's internal develop-run closed loop.

4. Platform Architecture

4.1. Component Layering

AgentCore's architecture can be summarized as four layers:

1. Access layer: any framework (LangChain / CrewAI / MAF / Strands, etc.) or AgentCore Harness configuration;
2. Harness layer: CreateHarness / InvokeHarness configurational wrapper + Bedrock Guardrails guardrails;
3. Component layer: Runtime (microVM execution), Gateway (tool gateway), Memory (memory), Identity (identity), Policy (policy), Observability (observability), Tools (built-in tools);
4. Resource layer: Bedrock model layer (multi-vendor models, switchable mid-session) + three-tier knowledge system + existing enterprise systems (integrated via Gateway).

4.2. Processing Flow of One Agent Invocation

1. The developer declares models, tools, skills, and instructions with CreateHarness (or writes an Agent with any framework);
2. InvokeHarness triggers a session, and Runtime allocates an isolated microVM instance;
3. Identity completes inbound/outbound authentication, and Policy validates whether this operation is out of bounds;
4. Gateway assembles the target API / Lambda / MCP Server into a tool invocation;
5. Memory injects short-term and long-term memory, and tool results supplement context via the three-tier knowledge system;
6. The entire execution is written to Observability (CloudWatch traces), and Guardrails intercept risky content in real time at the gateway layer;
7. Long-running tasks are carried persistently by Runtime instances (up to 14 days), with anomalies attributed by Insights via cross-session failure-pattern analysis.

5. Harness Design

5.1. Six-Layer Capability Overview

AgentCore is the platform with the highest six-layer completion among the 7 supplementary platforms in this batch, and all six layers take the form of a "cloud service with independently purchasable components". Together with Microsoft Agent Framework (a framework-form, all-six-layers-strong implementation) and Alibaba Cloud Bailian (a platform + open-source dual-track, all-six-layers-strong implementation), it constitutes three different "full-strength implementation paths".

5.2. L1 Context Engineering Layer

• The three-tier knowledge system is the backbone of AgentCore's L1: three levels of sources — enterprise knowledge (managed KB), public knowledge (Web Search), and paid knowledge (payment monetization) — converge within the same session;
• The Web Search connector indexes tens of billions of documents with minute-level refresh, mitigating the "outdated public knowledge" problem;
• Episodic Memory (up to 8 hours) provides episode-level recall, suitable for debugging and audit scenarios such as "replaying what just happened";
• The details of the context compression mechanism are not public (it is internal to the managed service); the configurable granularity is [To be verified].

5.3. L2 Tools and Execution Layer

• Firecracker microVM: an isolation foundation of the same lineage as Lambda, one of the strongest execution environments in this group (microVM-level, not container-level);
• Gateway is the "universal adapter": three target types — API, Lambda, MCP Server — are uniformly converted into tools, and authentication and Token rotation are managed — productizing the tool authentication layer that other platforms in this group require to be built in-house;
• Three hosted tools are built in: code interpreter, browser, and Web Search;
• GPU-accelerated execution (Runtime instances) covers model-inference-sensitive tasks.

5.4. L3 Orchestration and Control Layer

• Supervisor mode: the main Agent distributes tasks, child Agents execute them, and the main Agent aggregates results; Runtime instances support multi-Agent collaboration on the same instance;
• Long-running tasks: sessions of up to 14 days are the longest persistent-session window in this group (for comparison: LangGraph's persistent execution has no explicit upper limit but requires a self-built backend, while the OpenAI Agents API describes a window of "hours to days");
• Orchestration freedom: no restriction on orchestration style (graph / loop / handoff all allowed); L3's "strength" lies in carrying capacity rather than orchestration primitives — the orchestration primitives themselves are delegated to the framework layer;
• Interrupt and resume: relies on managed-instance persistence, but fine-grained interrupt / time travel primitives are not as mature as LangGraph's.

5.5. L4 Memory and State Layer

Comparison within this group: LangGraph provides mechanism primitives via Checkpointer + Store (self-built backend), while AgentCore offers a managed service (no operations burden); ADK distinguishes four scopes of State with finer semantics. AgentCore's Episodic memory carries a time cap (8 hours), suited to operations troubleshooting rather than very-long-horizon personalization.

5.6. L5 Evaluation and Observability Layer

• CloudWatch-native traces: every tool call and model call can be traced;
• Insights: automatic cross-session failure-pattern analysis — elevating "debugging a single session" to "attributing a class of failures", a batch-attribution capability rarely seen in this group;
• A/B testing: variant comparison on real traffic, "let the data decide which version to release" (official statement);
• 13 built-in Evaluators: standardized scoring covering quality and security dimensions;
• Gap: the specific list and scoring methodology of the Evaluators are not fully published, and regression-set management must be combined with external tools.

5.7. L6 Governance and Security Layer

• Policy engine: natural-language descriptions directly generate Cedar policies, lowering the barrier to policy engineering; the 2026-08 Dogwood temporal policies add "time-dimension authorization" (e.g. only during work hours, only within specific windows);
• Bedrock Guardrails: real-time interception of prompt injection, harmful content, and sensitive-data leakage at the gateway layer;
• Identity, bidirectional in/out: an Agent can both be invoked under an identity (who drives it) and access resources under a controlled identity (on whose behalf it acts) — a unique IAM heritage of cloud vendors;
• Cost governance: per-usage component billing naturally creates cost visibility, but the configuration granularity of hard budget guardrails is [To be verified].

5.8. Six-Layer Capability Diagram

Figure 15-1 | AgentCore Managed Harness Runtime Layering Diagram

Data source: AWS official product page and public updates (as of 2026-09-12), illustrative.

6. Real-World Cases

Case 1: The Kiro–AgentCore develop-run closed loop (vendor narrative)

Kiro is AWS's coding-agent IDE (see the existing 12-kiro.md) and is also AgentCore's "super user": Agents developed in Kiro can be deployed directly to run on AgentCore, forming the closed loop of "a tool for writing Agents + a platform for running Agents". This case is a vendor-narrative account; no independent third-party verification was found.

Case 2: Bedrock commercial growth (as relayed by brokerages)

Bedrock's customer count is in the hundreds of thousands, and 2026 Q2 customer spending exceeded the total of all prior quarters combined (per AWS earnings statements, as relayed through brokerage research reports). As the Agent layer on top of Bedrock, AgentCore's independent revenue contribution has not been disclosed separately.

Parts with no public quantitative data found: engineering metrics for AgentCore itself (Harness, Runtime instances, Memory, etc.) — such as customer-case counts, task-success-rate improvements, and cost-reduction percentages — had no public cases with verifiable data found; the availability in China (Beijing / Ningxia) and Web Search compliance also remain unconfirmed. This is stated as-is here, with no fabrication.

7. Summary

7.1. Advantages

1. All six layers strong and components separable: all six layers are independent cloud components — you can choose only Runtime + Gateway, or adopt Harness as a whole;
2. High isolation strength: Firecracker microVM is one of the strongest execution-isolation foundations in this group;
3. Both model and framework decoupled: any framework can enter, multiple vendor models are carried, and models can be switched mid-session, minimizing lock-in risk;
4. Long-running task capability: the 14-day session window is the longest managed-persistence capability in this group;
5. Governance depth: Cedar / Dogwood policies + Guardrails + IAM-level Identity, friendly to regulated industries;
6. L5 batch attribution: Insights' cross-session failure-pattern analysis and A/B testing are scarce capabilities at the evaluation layer.

7.2. Disadvantages

1. AWS lock-in: the isolation foundation, policy language (Cedar), and IAM system are all deeply bound to the AWS cloud;
2. Component assembly cost: the combination of seven components + Harness has a steep learning curve for small teams;
3. China-region uncertainty: availability in the Beijing / Ningxia regions and Web Search compliance are unconfirmed, making domestic deployment doubtful;
4. Observability granularity below self-built: the freedom of Trace details and custom metrics is constrained by the boundaries of the managed service;
5. Price transparency: Harness's per-usage unit-price table is not fully public, making cost estimation difficult.

7.3. Applicability Boundary

7.4. Selection Recommendations

• Comparison with Microsoft Agent Framework: MAF is "all six layers strong in framework form" (code in hand), while AgentCore is "all six layers strong in cloud-service form" (operations outsourced) — engineering teams building in-house prefer MAF, platform teams preferring managed prefer AgentCore;
• Comparison with Alibaba Cloud Bailian: both are cloud-vendor Runtime types; Bailian wins on domestic ecosystem and the evaluation-and-training closed loop (OpenJudge + RFT), while AgentCore wins on model decoupling and isolation strength;
• If only a framework is needed and not managed hosting, open-source frameworks such as LangGraph / MAF + a self-built sandbox are a low-cost alternative.

Information Gap Statement

1. Harness pricing: AgentCore Harness's per-usage unit-price table has not been fully disclosed officially; marked [To be verified].
2. China-region availability: component coverage in the Beijing / Ningxia regions and Web Search compliance are unconfirmed; marked [To be verified].
3. Dogwood policy language: the open-source repository address and specification details have not been verified; marked [To be verified].
4. Context compression mechanism: the context compression strategy and configurable granularity inside the managed layer are not public; marked [To be verified].
5. Evaluator list: the specific names and scoring methodology of the 13 built-in Evaluators are not fully public.
6. Customer engineering metrics: no third-party customer cases with verifiable data were found; the Kiro closed loop is a vendor-narrative account.
7. Runtime instances pricing: the GPU models and billing method for long-running instances have not been fully disclosed; marked [To be verified].

8. References

1. Amazon Bedrock AgentCore — AWS official product page. https://aws.amazon.com/bedrock/agentcore/
2. Amazon Bedrock AgentCore — AWS official documentation. https://docs.aws.amazon.com/bedrock-agentcore/
3. Coverage of AWS announcing AgentCore Harness GA — Sina Finance, 2026-06-18. https://finance.sina.com.cn/stock/t/2026-06-18/doc-inicuyvt6508873.shtml
4. Coverage of AgentCore Harness and Runtime instances updates — Sina Tech, 2026-06-18. https://finance.sina.com.cn/tech/roll/2026-06-18/doc-inicvfcr6499767.shtml
5. Amazon Bedrock Guardrails — AWS official documentation. https://aws.amazon.com/bedrock/guardrails/
6. Kiro — AWS coding-agent IDE official site. https://kiro.dev/
7. Amazon Bedrock Agents and Knowledge Bases — AWS official. https://aws.amazon.com/bedrock/
8. CITIC Construction Investment Securities: AWS Bedrock AgentCore industry-chain research report (2026, republished via ima.qq.com) — document title + institution + year, original URL not verified.
9. R18-IDE-Agents-supplementary-platforms search report — this project's internal search report (AG-1 key-facts card).
10. Project parameter card v1.1 (Harness six-layer capability model) — this project's internal baseline document.