From the AWS edition of October 30, 2026
AWS public sector guidance proposes a 30-minute 'delegation audit' for Bedrock AgentCore agents, insisting boundaries be enforced outside the model
Amazon Web Services (AWS Public Sector) · Cross-SLED (agentic AI governance) · Global guidance; U.S. public sector audience
- Publisher
- AWS Public Sector Blog
- Original publication
- 2026-10-28
- Source retrieved
- 2026-10-31
What happened
AWS authors propose a whiteboard audit: draw every handoff from user to agent, to tools, to data. At each arrow, ask five questions (boundary check, worst single failure, reversibility, who gets hurt, what risk is accepted) and mark it red, yellow or green. Any boundary enforced only by the model is red. They recommend a 5-minute injection test with a planted instruction in the knowledge base. They also recommend 'proof-carrying work', where the evidence returned rises with the consequence. Their worked example is an agent updating an eligibility record with caseworker approval and readback. AWS controls named include AgentCore Policy (Cedar), scoped IAM, approval gates and Bedrock Guardrails, with filters positioned as a complement, not a substitute.
Why it matters
Applies to any state or local agency piloting agents that take actions, such as benefits eligibility updates, ticket creation or resident notifications. The worked example is an HHS-style eligibility record.
Evidence and measured results
Vendor guidance with no case study, test results or measured failure rates. The claim that a first pass usually finds several red handoffs is the authors' expectation, not data. It builds on a companion AWS post that was not inspected.
Limitations and uncertainty
Self-described triage, not a full security assessment. Vendor-authored, with no evidence the method reduces incidents. Read alongside independent research showing AgentCore's own defaults were overprivileged until late September 2026.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies piloting AI agents lack a quick way to see where agents can act or access data without enforced limits.
- Stakeholders
- Agency CISO
- AI governance board chair
- Program owner (e.g., benefits eligibility)
- Agency CIO
- Internal audit
- Discovery questions
- Which pilot agents can write records, send messages or create tickets today?
- Who signs off on accepted AI risks?
- Is retrieval filtered by user permission at query time?
- Do agents return evidence of what they did, or just 'task completed'?
- Value hypothesis
- A short structured audit can surface unreviewed agent handoffs early, before they become incidents, at very low cost.
- Potential engagement
- Facilitated delegation audit on one or two pilot agents, producing a prioritized remediation list and a proof-packet design.
- Unsupported claims
- That the audit finds all agent risks
- Any measured reduction in incidents
- That Guardrails filters alone stop prompt injection
- That AgentCore defaults are least-privilege
Pre-sales engineering
Role takeaway
- Fit
- Fits any agent architecture. AWS-specific controls apply to AgentCore deployments.
- Architecture and integration
- Enforce tool authorization with AgentCore Policy (Cedar) outside the model, use per-tool IAM roles and query-time authorization on knowledge bases, add approval gates, and log every tool call.
- Prerequisites
- Inventory of agent tools and data sources
- Per-user identity propagated to the agent
- Logging of tool calls
- Named risk owner
- Constraints
- Triage method, not a full assessment
- Model-based filters are probabilistic
- Proof packets add latency and storage
- Security
- Treat retrieved content as untrusted. Require confirmation for destructive actions. Verify execution-role permissions rather than relying on defaults.
- Proof of value
- Run the planted-instruction injection test on each retrieval path
- Attempt cross-user retrieval to confirm query-time filtering
- Verify an irreversible tool cannot fire without approval
- Check that the proof packet allows independent readback of the outcome
Delivery
Role takeaway
- Work
- Facilitate audits, track remediation, implement approval gates and proof packets, and schedule re-audits.
- Dependencies
- Access to agent architecture and IAM configuration
- Program owner participation
- Governance board for risk acceptance
- Ownership
- Agency CISO or AI governance lead owns the audit cadence. Product owners own remediation of their agents.
- Skills and adoption
- Teach product teams the five questions and how to run the injection test themselves.
- Governance checkpoints
- Audit before pilot launch
- Red-handoff disposition before production
- Quarterly re-audit
- Documented risk acceptance by named official
- Acceptance criteria
- Proposed: zero unaccepted red handoffs at production go-live
- Proposed: injection test fails (instruction not followed) on 100% of retrieval paths
- Proposed: every consequential action produces a complete proof packet in UAT
- Risks
- Audit treated as a one-time checkbox
- False confidence from green ratings without testing
- New tools added post-audit
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Separate input and data channels, and authorize tool calls outside the model's reasoning loop (Cedar policies in AgentCore). Use least-privilege IAM per tool, apply query-time authorization on retrieval, and pause before irreversible actions.
Governance
Who approves, reviews and stays accountable for outcomes?
Calls for documented risk acceptance with a named decision-maker, severity and rationale. Red handoffs should be restricted or disabled until formally accepted, and green arrows re-reviewed quarterly. These map well to agency AI governance boards.
Security and privacy
What data, permissions and controls need testing?
Names prompt injection, excessive agency and information disclosure as connected threats. Retrieved documents are to be treated as untrusted data, and every tool call logged.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Low barrier: needs a whiteboard and 30 minutes, which suits small IT teams. Still requires someone who understands the agent's tools and data flows.
Procurement
What should contracts, pricing and exit terms secure?
Agencies can ask vendors to present a completed delegation map and proof packet design as a condition of award or go-live.
Operating model
Which teams own the service once it runs?
Introduces recurring quarterly reviews and an action list with owners and dates for each red or yellow handoff.
Publication history
- 2026-10-30AWS · Issue 027 resources
Stable resource ID: aws-agentcore-delegation-audit-guidance-20261028