Use cases / AWS Bedrock
Build on Bedrock. Govern the whole workflow.
Put your Bedrock agents to work with control over what they can do, who must approve, and how far they can go. One reviewed policy across AWS, the enterprise systems your agents reach, and the rest of your AI stack.
- Keep your AWS controlsGuardrails, AgentCore Policy and IAM stay. GovernorAI adds the business decision alongside them.
- Decide before dispatchAllow, pause for the right owner, deny, or shape the arguments. The tool runs in your account.
- Trace decision to outcomePolicy, approval, decision, dispatch and result in one record. Allowed is not the same as executed.
Over the $500 automatic threshold. $900 is held for Finance before the refund executor runs. A request nobody decides expires after 15 minutes.
execution: NOT_DISPATCHED · browser demoInspect this decision
Switch paths: the same policy decides.
Day one
What changes on day one
Security
Consequential tool calls are decided before they run, on the Bedrock Agents Classic agents you operate; the AgentCore path is planned. A refund over the limit waits for Finance; a bucket delete is refused with the rule that decided.
Example rule: ops.destructive.block-delete
GRC
Gateway decisions are recorded with the policy, the approver and what actually happened afterwards. An out-of-band edit to a guardrail becomes a finding, not a surprise at audit.
Example evidence: dec_118204 → NIST AI RMF GOVERN 1.3
Platform and AI engineering
No agent code changes. Policy lives as code in the engine you already use, compiles into the AWS-native controls.
Engines: GovernorAI native, OPA/Rego
In the product
See one policy previewed for Bedrock, in the console.
Recorded on a demo tenant: one governance policy previewed as an AWS Bedrock guardrail, the same policy for a second provider, every agent on one map, and decisions from every platform in one log.
One policy, step by step
Real product screens from a demo tenant with seeded activity. The provider outputs are previews of what the policy becomes for each target; nothing was applied.
What’s different
Different agents. The same business boundaries.
Govern the work, not just one prompt, one gateway or one cloud. Carry authority, limits and evidence from the first request to the final action.
A new session is not a new spending limit.
Keep one limit for the customer case, project or business process, even when the work moves between agents, sessions and platforms. The limit is keyed to the case, not to a session id the caller chose.
Approve this action. Not open-ended access.
Route consequential actions to the owner who is accountable for them. The owner’s decision on this held request is recorded. It does not release the call, and a changed request is evaluated again.
Show why it was allowed. And what actually happened.
An approval is not an execution, and a timeout is not proof that nothing ran. Each action carries its own state from evaluation to the executor's result, so a reviewer can tell them apart.
evaluatedpending approvalauthorizedreserveddispatchedconfirmedfailedunknown On AWS
Deep in your AWS stack. Connected to everything after it.
Two enforcement paths on AWS, one governance model. Start with the one you run today.
AgentCore Planned
New agents, and Classic agents you are migrating
- Planned: a GovernorAI request and response interceptor on your AgentCore gateway, so tool calls get the business decision before dispatch and shaped responses after it.
- Planned: compiling your reviewed policy to Cedar and Dogwood for the gateway's policy engine, preserving customer-authored policies.
- Planned: drift patrol comparing what that engine enforces with what was approved.
- Supported target types, directions and streaming modes are declared per adapter. An unsupported path is reported, not labelled governed.
Bedrock Agents Classic
The agents you already run, in maintenance mode since July 2026
- The action group's executor points at the governor Lambda proxy in your account. The proxy asks for a verdict, then executes the tool itself.
- Enabling governance records the original executor ARN. Disabling restores it, per action group, with a region-correct write.
- No agent, prompt or SDK changes. The gateway never makes the model call on this path.
- Discovery across ten Bedrock regions shows what exists and which action groups are already pointed at a governor proxy.
Bedrock agent, unchangedexecutor → governor-bedrock-proxyasks first, executes secondPOST /api/v1/gateway/executePolicy, limits, approvals, data controls, evidence.
allow · deny · pendingShaped arguments are re-verified against the exact payload the proxy sends.
Planned: move from Classic to AgentCore with your governance intact.
AWS gives you the migration tooling. Carrying what the tooling does not, the reviewed policies, who approves what, the case history behind your limits and evidence that compares before and after, is planned with the AgentCore path.
- Planned: replay representative actions on both paths and review any decisions that diverge.
- Planned: run the AgentCore path in shadow mode beside Classic before cutover.
- Planned: carry policies, limits and decision history across, so a migrated agent is governed by the same rules.
- Planned: keep one evidence chain across the migration, with the path recorded on every decision.
Six outcomes
More control. Fewer dead ends.
Binary allow-or-block leaves teams choosing between risk and friction. GovernorAI returns six outcomes, so most requests can proceed in a safe form. Every enforcement point declares which it can truthfully execute; choosing an outcome a point cannot execute fails closed to deny.
allowproceedsThe tool runs with the arguments it was given. The policy and rule that matched are recorded.
pauseheld for an ownerThe action waits for the accountable approver. The hold expires, an approval releases nothing, and a changed request is evaluated again.
denyrefusedThe call is refused with the reason and the rule that decided, so the agent can explain itself and the record shows why.
redactshapedWith proofSensitive spans in the arguments, and in this point's own response text, are replaced and then re-scanned to prove the original cannot be detected.
maskshapedSame path as redact: shape, then verify the original value is gone. Useful where a format must survive, like a card number ending.
constrainnarrowedNarrow an argument before dispatch: cap an amount, pin a region, drop a wildcard. Request side only, and the narrowed payload is re-authorized.
A shaped payload that cannot be parsed is treated as a denial, never a silent fall-back to the originals. The same holds for response text: shape, re-scan, prove the original value is gone, or fail closed.
Why not just AWS
Why not just use what AWS gives you?
Use it. Bedrock Guardrails decide whether content is acceptable. AgentCore Policy decides whether a rule permits a tool call through an AgentCore gateway, including session-aware rules. GovernorAI decides whether this agent may take this action, with these arguments, under this business limit, with this approval, and records what happened next. They answer different questions, and the last one is the one an auditor asks. The table is the feature view; the section after it is the reason the feature view is not the point.
| Question | Bedrock Guardrails | AgentCore Policy (Cedar, Dogwood) | GovernorAI adds |
|---|---|---|---|
| What it decides | Is this content acceptable to process or emit? | Does a permit rule match this tool call, given this session's history? | May this agent take this action, with these arguments, under this business limit, with this approval? And what happened next? |
| Bedrock Agents Classic (InvokeAgent and action groups) | PartialModel call only | —AgentCore gateway traffic only | YesInside the action group, no agent changes |
| AgentCore Gateway agents | YesThrough Policy, since July 2026 | Yes | PlannedA request and response interceptor is planned |
| Human approval before the tool runs | — | PartialAn earlier approve action in the same session can be a prerequisite | YesRouted to the accountable owner; the decision is recorded, and the hold expires |
| A limit that survives a new session, account or region | — | —Session-scoped, caller-supplied session id, same account and region, 24h window | YesShared limit keyed to the case, across agents and platforms |
| Transform arguments or responses | PartialPII filters and content blocks | PartialLambda interceptors you write and operate | Yesredact, mask, constrain as policy outcomes, with re-scan proof |
| Same policy on Azure, GCP, Salesforce, ServiceNow, MCP and Kubernetes | — | — | YesOne policy object, every enforcement point |
| Know when the live control no longer matches the approved policy | PartialCloudTrail records the edit | PartialCloudTrail records the edit | YesDrift patrol compares live configuration with the approved version |
| Evidence from decision to actual outcome | PartialCloudTrail and CloudWatch logs | PartialPolicy metrics and spans | YesDecision, approval, dispatch and executor result in one record |
| Reversible enrolment | n/a | n/a | YesDisable restores the original executor ARN |
| Independent of the platform vendor | — | — | YesThe policy and the record survive a platform change |
Scroll the table sideways to see all columns.
— marks a question outside that control’s scope. The AWS controls keep doing what they do; GovernorAI adds the business decision on top.
Even on one platform
Even if everything you run is on AWS.
"Single cloud" describes where your agents run. Governance is about what they do, who answers for it, and what you can prove. None of those stop at the account boundary.
One AWS workflow. Your approval policy in control.
A proposed $900 refund requires Finance approval under your business policy. GovernorAI holds the action before the refund executor runs and records the decision, alongside your existing IAM controls. That governance workflow adds value even when every agent runs on AWS.
You didn't choose multi-platform. Your vendors did.
Salesforce, ServiceNow and Microsoft 365 now ship their own agents. The all-AWS company already has three governance consoles and no single answer. The mixed estate is the state you are in, not a state to plan for.
A control the platform runs on itself is line one.
The builders' console should not be the policy editor, the enforcer and the audit log at once. Risk and audit need a control that is independent of the system it controls. SOC 2, ISO 42001 and the NIST AI RMF all expect that separation.
Finance doesn't log in to the AWS console.
GovernorAI routes the refund to its accountable owner where owners already work, expires a request nobody decides, records who said yes, and keeps that record attached to the action.
The platform will change under you.
Classic went to maintenance mode in July, eight months after AgentCore Policy shipped. Policy written in Cedar for one gateway, and evidence stored in one product, are rewritten or stranded at the next re-platform. Intent written once and compiled into the native control outlives the version.
"Governed" should be a number you can see.
Agent Registry lists what AWS knows about. Discovery that is independent of the platform counts the agent in the other account, the action group that bypasses the gateway, the SaaS agent nobody registered, and refuses to call an uninstrumented path governed.
One refund, end to end.
In this example, the refund rule is managed in GovernorAI, alongside the IAM policies your team already runs.
- AWS In this example, the configured IAM policies permit the call: this agent may use the refund tool.
- GovernorAI The refund policy managed in GovernorAI requires Finance approval above the $500 automatic threshold, so the $900 refund is held. The refund executor is not invoked while it is held.
- Finance The named approver decides. Who approved, and when, is recorded with the decision.
- Record One record carries the policy and rule that decided, the approver and the outcome, outside the AWS console.
And when you are not single-cloud: one policy, one ledger, one evidence chain across AWS, Azure, Google Cloud, Databricks, Kubernetes, MCP, Salesforce and ServiceNow. See how one policy governs everywhere
Coexistence
Keep your AWS controls. Connect the whole workflow.
A reviewed GovernorAI policy is the intent. The AWS-native control is one implementation of it. The policy compiles into that control. With an AWS client configured, GovernorAI syncs it and watches it for drift, so somebody editing it in the console is a finding. Out of the box the control plane wires no AWS client.
Compile
Each clause is classified by purpose: content, authorization, argument constraint, workflow rule, approval. Supported clauses compile deterministically, with a hash over the result. Unsupported clauses are reported, never dropped.
POST /api/v1/guardrails/compileSync
Preview the semantic diff, approve, then push it with a configured AWS client. The identifier AWS returns is recorded alongside the hash that produced it.
POST /api/v1/guardrails/{id}/syncDiff
Compare what the policy compiles to now against what was synced, before anything is pushed again.
GET /api/v1/guardrails/{id}/diffDrift-check
Read the live configuration back, normalize it, hash it, compare. A mismatch is a finding that names the fields that changed.
POST /api/v1/guardrails/{id}/drift-checkPatrol
A scheduled worker runs the drift check continuously. Repair is opt-in, previewed in dry-run, and touches only the fields GovernorAI manages.
drift patrol · dry_run | applyBedrock Guardrails
Content rules compile into denied topics and filters. Tool denials are enforced at the action boundary, not as topics, because a blocked topic is not an authorization decision. Where you attach the guardrail to the model call, it applies the provider's content policy there; GovernorAI does not attach it for you yet.
AgentCore Policy Planned
Compiling authorization and session-aware clauses to Cedar and Dogwood for the AgentCore policy engine is planned. Today those clauses are enforced at the GovernorAI action boundary.
Neither answer substitutes for the other. Running both, from one reviewed policy, is the point.
Discovery
Know what exists, who owns it, and what is actually governed.
AWS Agent Registry already catalogs agents, tools and MCP servers across your organization. GovernorAI connects that inventory to ownership, business policy and real control coverage, so the question is not "what exists?" but "which consequential paths are governed, and which are not?"
| Region | Agents | Enforced | Unknown path |
|---|---|---|---|
us-east-1 | 14 | 12 | 2 |
us-west-2 | 9 | 9 | 0 |
eu-west-1 | 6 | 4 | 2 |
eu-central-1 | 3 | 3 | 0 |
ap-northeast-1 | 2 | 0 | 2 |
ap-southeast-1 | 1 | 0 | 1 |
ap-southeast-2 | 1 | 1 | 0 |
ap-south-1 | 0 | — | 0 |
ca-central-1 | 2 | 2 | 0 |
sa-east-1 | 1 | 0 | 1 |
Eight agents have a tool path GovernorAI has not instrumented. Those are the ones to ask about first. Sample data
registry: trueAWS Agent RegistryPlanned: ingest registry records and the auto-detected AgentCore runtimes and gateways, reconcile them with direct discovery, and attach owner, policy and coverage state to each.
scan_all_regions: trueSweep the Bedrock catalogScan every Bedrock region in the connector's catalog, up to five concurrently. Results are de-duplicated by agent and region.
regions: [ … ]Scan a named setSome organisations know exactly which regions are sanctioned. Name them and only those are queried. Region strategy is explicit, never implied.
coverage: strictNo silent "governed"An agent with a direct, uninstrumented tool path is shown as unknown, not as protected. Coverage is a denominator you can see.
Evidence
Every decision in a record you can hand to an auditor.
Each action is written as a record: the identity behind it, the tool, the arguments as received and as shaped, the policy and the rule that matched, when one did, the approver where there was one, the dispatch, and the executor's result. An authorized action with no confirmed result stays unknown until it is reconciled.
id dec_118204 prev sha256:9f3c…e21a principal oauth:sub 4f1a… via refund-agent (Bedrock Agents Classic) tool payments.issue_refund args.in { order: 88213, amount: 900 } policy finance.refunds engine: builtin rule approval-over-500 approval finance / m.rahman 14:02:11Z expires 14:17:11Z state authorized → reserved → dispatched → confirmed result txn 7c2e… executor: lambda:refund-tool controls NIST AI RMF GOVERN 1.3 · ISO 42001 A.6.2 · SOC 2 CC6.1 hash sha256:4b07…c93d
Mapped to the controls you report against
Records carry control references, so an evidence export for a given framework is a query, not a project.
- NIST AI RMF
- ISO/IEC 42001
- SOC 2
- EU AI Act
- PCI DSS 4.0
Lands where your security team already looks
Decisions export to Amazon Security Lake in OCSF, and drift findings raise in Security Hub, so agent governance shows up next to everything else in the account.
Get started
Govern one workflow in an afternoon. Roll it back in a minute.
- Connect the account
A read-only role for discovery. Nothing changes until you choose a workflow.
- Enrol the path your agent uses
On Classic, the action group executor is repointed and the original ARN recorded. The AgentCore interceptor is planned. You see the resources that will change before anything is written.
- Write policy as code, in your engine
GovernorAI native or OPA/Rego, mixed per policy. Run it in shadow mode against real traffic, then enforce. Or let an agent run for a few days and have the draft written from what it actually did.
- Watch the first decisions land
Decision observability shows the verdict behind every action, and the record starts on the first call. Disable restores the original state.
Where things run
- Tool execution
- In your account: your Lambda, your network.
- Decision
- The tool name, arguments and identity context are sent to the GovernorAI decision service; the verdict and any shaped arguments come back. Private connectivity keeps that round trip off the public internet.
- Redaction
- Applied before anything is forwarded, with a re-scan proof.
- Evidence
- Written by GovernorAI; exportable to your account.
A per-call verdict is the right control for an action in flight. It is the wrong place to learn the agent should never have shipped. Assurance scores a pinned snapshot against bars set before the run, so the thing that passed and the thing that ships are provably the same.
Questions
Good questions. Direct answers.
Why add GovernorAI if we already use IAM and AgentCore?
GovernorAI connects business policy, required approvals, execution controls, and decision evidence in one independent governance workflow—even when every agent runs on AWS.
Keep IAM and AgentCore in place. In the refund example, the configured AWS policies permit the call, while the business policy managed through GovernorAI requires Finance approval for the $900 refund. GovernorAI holds the action before the refund executor runs and records the decision. Your team can manage the approval rule, control execution, and review the decision through one workflow.
The value begins with your first AWS workflow and extends as your platform footprint grows.
Does this replace Bedrock Guardrails?
Does any data leave my AWS account?
What happens if the decision service is unreachable?
My agents are on Bedrock Agents Classic. Am I about to lose them?
How do I get out?
Design-partner evaluation
Give your Bedrock agents more work. Not more unchecked power.
Six weeks, one consequential workflow, success criteria named before we start. The evaluation licence is waived; you pay your cloud provider for infrastructure.