{"resourceId":"aws-agentcore-delegation-audit-guidance-20261028","versions":[{"version":"external-9d1ff6a63aa052abf2c930cb4689106611581537d7bf80a6c7089537a0c658c2","resource":{"id":"aws-agentcore-delegation-audit-guidance-20261028","title":"AWS public sector guidance proposes a 30-minute 'delegation audit' for Bedrock AgentCore agents, insisting boundaries be enforced outside the model","organization":"Amazon Web Services (AWS Public Sector)","sector":"Cross-SLED (agentic AI governance)","geography":"Global guidance; U.S. public sector audience","publishedAt":"2026-10-28","publicationDate":"2026-10-28","eventDate":null,"sourceName":"AWS Public Sector Blog","sourceLabel":"AWS Public Sector Blog — vendor security guidance","sourceUrl":"https://aws.amazon.com/blogs/publicsector/secure-the-handoff-a-delegation-audit-for-amazon-bedrock-agentcore/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security","governance-procurement","operating-model"],"finding":"AWS authors propose a whiteboard audit: draw every handoff from user to agent, to tools, to data. At each arrow, ask five questions (boundary check, worst single failure, reversibility, who gets hurt, what risk is accepted) and mark it red, yellow or green. Any boundary enforced only by the model is red. They recommend a 5-minute injection test with a planted instruction in the knowledge base. They also recommend 'proof-carrying work', where the evidence returned rises with the consequence. Their worked example is an agent updating an eligibility record with caseworker approval and readback. AWS controls named include AgentCore Policy (Cedar), scoped IAM, approval gates and Bedrock Guardrails, with filters positioned as a complement, not a substitute.","sledRelevance":"Applies to any state or local agency piloting agents that take actions, such as benefits eligibility updates, ticket creation or resident notifications. The worked example is an HHS-style eligibility record.","evidence":"Vendor guidance with no case study, test results or measured failure rates. The claim that a first pass usually finds several red handoffs is the authors' expectation, not data. It builds on a companion AWS post that was not inspected.","architectureImplications":"Separate input and data channels, and authorize tool calls outside the model's reasoning loop (Cedar policies in AgentCore). Use least-privilege IAM per tool, apply query-time authorization on retrieval, and pause before irreversible actions.","governanceImplications":"Calls for documented risk acceptance with a named decision-maker, severity and rationale. Red handoffs should be restricted or disabled until formally accepted, and green arrows re-reviewed quarterly. These map well to agency AI governance boards.","securityPrivacyImplications":"Names prompt injection, excessive agency and information disclosure as connected threats. Retrieved documents are to be treated as untrusted data, and every tool call logged.","caveats":"Self-described triage, not a full security assessment. Vendor-authored, with no evidence the method reduces incidents. Read alongside independent research showing AgentCore's own defaults were overprivileged until late September 2026.","streamIds":["aws"],"roles":{"sales":"Sales framing: this is a practical, vendor-neutral-sounding conversation starter for agencies moving from chatbots to agents that act. Offer to run the 30-minute audit with the agency's team on one pilot workflow, such as an eligibility update or ticket creation, and leave behind a prioritized list. Be explicit that this is AWS guidance without outcome data. Its value is surfacing unexamined handoffs, not certifying safety. Pair it with the independent AgentCore credential research to show why defaults should not be trusted.","engineering":"Engineering framing: the core rule is that no boundary may rely on the model alone. Map each tool call and data source, then enforce deterministic checks: Cedar policies in AgentCore, per-tool IAM scoping, query-time retrieval authorization, and approval gates for irreversible actions. Run the injection test against every retrieval path. Implement proof packets for consequential actions: objective, authority, inputs, execution record, verification and residual uncertainty. Treat Guardrails filters as a supplement, and verify default execution roles independently.","delivery":"Delivery framing: build the audit into the agent delivery lifecycle as a gate before pilot and before production. Each red or yellow handoff becomes a backlog item with an owner and a target date. Unresolved reds are disabled or formally accepted by a named official. Proof-packet requirements should scale with consequence tier and be checked in user acceptance testing. Schedule quarterly re-audits, because tools added during sprints often escape review."},"roleDetails":{"sales":{"customerProblem":"Agencies piloting AI agents lack a quick way to see where agents can act or access data without enforced limits.","stakeholders":["Agency CISO","AI governance board chair","Program owner (e.g., benefits eligibility)","Agency CIO","Internal audit"],"discoveryQuestions":["Which pilot agents can write records, send messages or create tickets today?","Who signs off on accepted AI risks?","Is retrieval filtered by user permission at query time?","Do agents return evidence of what they did, or just 'task completed'?"],"valueHypothesis":"A short structured audit can surface unreviewed agent handoffs early, before they become incidents, at very low cost.","potentialEngagement":"Facilitated delegation audit on one or two pilot agents, producing a prioritized remediation list and a proof-packet design.","unsupportedClaims":["That the audit finds all agent risks","Any measured reduction in incidents","That Guardrails filters alone stop prompt injection","That AgentCore defaults are least-privilege"]},"engineering":{"fit":"Fits any agent architecture. AWS-specific controls apply to AgentCore deployments.","architectureIntegration":"Enforce tool authorization with AgentCore Policy (Cedar) outside the model, use per-tool IAM roles and query-time authorization on knowledge bases, add approval gates, and log every tool call.","prerequisites":["Inventory of agent tools and data sources","Per-user identity propagated to the agent","Logging of tool calls","Named risk owner"],"constraints":["Triage method, not a full assessment","Model-based filters are probabilistic","Proof packets add latency and storage"],"security":"Treat retrieved content as untrusted. Require confirmation for destructive actions. Verify execution-role permissions rather than relying on defaults.","proofOfValue":["Run the planted-instruction injection test on each retrieval path","Attempt cross-user retrieval to confirm query-time filtering","Verify an irreversible tool cannot fire without approval","Check that the proof packet allows independent readback of the outcome"]},"delivery":{"work":"Facilitate audits, track remediation, implement approval gates and proof packets, and schedule re-audits.","dependencies":["Access to agent architecture and IAM configuration","Program owner participation","Governance board for risk acceptance"],"ownership":"Agency CISO or AI governance lead owns the audit cadence. Product owners own remediation of their agents.","skillsAdoption":"Teach product teams the five questions and how to run the injection test themselves.","governanceCheckpoints":["Audit before pilot launch","Red-handoff disposition before production","Quarterly re-audit","Documented risk acceptance by named official"],"acceptanceCriteria":["Proposed: zero unaccepted red handoffs at production go-live","Proposed: injection test fails (instruction not followed) on 100% of retrieval paths","Proposed: every consequential action produces a complete proof packet in UAT"],"risks":["Audit treated as a one-time checkbox","False confidence from green ratings without testing","New tools added post-audit"]}},"retrievedAt":"2026-10-30T22:09:59-05:00","enrichedAt":"2026-10-30T22:17:58-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Low barrier: needs a whiteboard and 30 minutes, which suits small IT teams. Still requires someone who understands the agent's tools and data flows.","procurementImplications":"Agencies can ask vendors to present a completed delegation map and proof packet design as a condition of award or go-live.","operatingModelImplications":"Introduces recurring quarterly reviews and an action list with owners and dates for each red or yellow handoff.","sourceVerification":{"openedUrl":"https://aws.amazon.com/blogs/publicsector/secure-the-handoff-a-delegation-audit-for-amazon-bedrock-agentcore/","referenceExcerpt":"A boundary that depends only on the model is a suggestion, not a control.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}