Artificial Intelligence Mergers and acquisitions (M&A) teams face a persistent challenge: conducting thorough due diligence on multiple acquisition targets while maintaining speed and analytical rigor. Teams often spend weeks manually reviewing targets before identifying viable opportunities. Amazon Bedrock AgentCore is a platform to build, connect, and optimize agents at scale, with any framework or model. It can accelerate this process by orchestrating AI agents that handle data gathering, analysis, and compliance checks autonomously within defined guardrails.
In this post, we show how to build a multi-agent due diligence system on Amazon Bedrock AgentCore. We present a reference architecture that combines agent orchestration, knowledge retrieval, and governance controls, then walk through deploying and running the solution using a complete sample repository.
The M&A due diligence challenge #
In transportation and logistics, for example, analysts pull data from financial databases, market research applications, regulatory filings, and internal knowledge bases, then reconcile that information by hand. The process is slow and resource intensive.
The problem compounds when teams duplicate work. Industry research, valuation models, and competitive analyses get recreated for each new deal instead of building on institutional knowledge from prior transactions. Meanwhile, governance concerns slow AI adoption because legal and compliance teams require confidence that AI-generated insights are accurate, traceable, and supported by source citations.
These four pressures (slow cycles, fragmented data, duplicated effort, and governance requirements) create an opportunity for AI agents to fundamentally change how due diligence operates.
How AI agents transform due diligence #
AI agents address each of these challenges through a combination of autonomous data gathering, intelligent routing, persistent memory, and built-in auditability.
On the data-gathering front, agents autonomously query multiple sources (financial databases, knowledge bases, market data APIs) and synthesize the results into preliminary assessments. In our testing, work that previously required weeks of analyst time was completed in hours because the agent handles the repetitive search-and-summarize loop without human intervention.
For prioritization, agents evaluate opportunities against strategic criteria and route high-priority deals to the right specialists. Rather than reviewing every target sequentially, the system surfaces the most promising candidates first and flags the specific dimensions (financial performance, strategic fitness, compliance risk) that warrant deeper analysis. Agents also build institutional knowledge over time. Each completed analysis enriches a shared memory layer so that future deals benefit from prior research, valuation assumptions, and integration lessons. Teams stop recreating context from scratch.
Governance is built into the agent workflow from the start, not added as an afterthought. The system is configured so that each assertion the agent emits is grounded in a citation, validated by the citation-check evaluator. Each agent invocation produces an audit trail, and guardrails enforce organizational policies at runtime. Compliance teams can trace each cited claim back to its source document.
Architecture decision: integrated suite or custom build #
We present two implementation paths, each suited to different organizational needs.
Option 1: Amazon Quick (integrated solution)
Amazon Quick provides ready-to-use AI capabilities tailored for business intelligence and research workflows. It offers a fast path to production if your needs align with standard analysis patterns. Amazon Quick Research generates professional, exportable in-depth reports. Amazon Quick Flows automates repetitive tasks with pre-built workflows. Amazon Quick Index delivers unified search across connected data sources.
Choose Amazon Quick if you want to deploy rapidly, your workflows align with standard business intelligence patterns, and you prefer fully managed services over custom development. For additional information and reference architecture, see the Announcing Amazon Quick.
You can also extend Quick with custom Amazon Bedrock AgentCore agents for specialized requirements such as proprietary valuation models or strategic fit frameworks. For a practical example of this pattern, see Building Intelligent Contract Management with Quick and AgentCore. That post demonstrates how Amazon Quick handles document management and the user interface while Amazon Bedrock AgentCore powers specialized agent collaboration.
Option 2: Custom architecture with Amazon Bedrock AgentCore
Amazon Bedrock AgentCore gives you fine-grained control over agent behavior, memory, and coordination. This approach suits M&A teams with proprietary methodologies, complex multi-agent coordination requirements, integration with specialized internal systems, or a need for complete control over agent behavior and model selection.
The remainder of this post explores this custom architecture in detail using a transportation-and-logistics due diligence scenario as context. We deploy a working multi-agent system, invoke it against synthetic targets, and validate outputs through an automated citation-check evaluator.
Reference architecture #
For M&A teams choosing the custom path, the following reference architecture shows how the pieces fit together end to end. The architecture uses Amazon Bedrock AgentCore to orchestrate a multi-agent due diligence workflow. A supervisor agent coordinates four specialist agents, each responsible for a distinct phase of the due diligence process. Users interact through a Jupyter notebook or terminal interface, while AgentCore runtime manages agent execution and collaboration. The system combines Retrieval Augmented Generation (RAG), structured financial analysis, external tool integration, memory, and policy-based governance to support production-ready due diligence workflows.
Agent orchestration layer
Amazon Bedrock AgentCore runtime coordinates multiple specialized agents through the Strands Agents SDK. The supervisor agent uses the agents-as-tools pattern to route requests to domain-specific specialists based on task requirements.
The Target Screening Agent identifies acquisition candidates by converting natural-language queries into SQL and executing them against Amazon Aurora PostgreSQL. When analysts ask for “mid-market logistics companies with revenue between 100M and 500M USD and EBITDA margins above 12 percent,” the agent translates that into a parameterized query. It then retrieves matching rows and enriches the results with narrative context from the knowledge base.
The Financial Analysis Agent performs valuation analysis using structured and unstructured data sources. It applies standard valuation methodologies including discounted cash flow (DCF) analysis and comparable company analysis, pulling market multiples through an AgentCore Gateway-backed tool. The agent generates preliminary valuations with supporting assumptions documented inline and flags management projections that diverge from historical performance.
The Strategic Fit Agent evaluates integration risks, synergies, and organizational alignment. It retrieves context from prior transactions stored in AgentCore memory (using a dedicated prior_deals
namespace). It then compares the current target’s profile against completed acquisitions and identifies integration risks with citations to source memos.
The Compliance Validation Agent audits responses against the M&A governance checklist. It invokes a custom citation-check evaluator (implemented as an AWS Lambda function) that examines every factual claim in a response and flags assertions that lack a supporting source citation.
Key architecture components
The architecture combines structured and unstructured enterprise data to ground agent responses in verified sources.
Amazon AuroraPostgreSQL Serverless v2 stores structured financial and operational datasets. The Target Screening Agent generates SQL from natural language and executes queries through the RDS Data API, providing fast access to target-company metrics without requiring analysts to write SQL themselves.Amazon Bedrock Knowledge Bases, the fully managed RAG capability in Amazon Bedrock, indexes due diligence documents including confidential information memoranda (CIMs), financial statements, press packs, and internal governance checklists. Agents retrieve relevant passages and cite them inline.AgentCore Gateway, a capability of Amazon Bedrock AgentCore, lets agents securely interact with external tools and services through Model Context Protocol (MCP)-compatible integrations. In this architecture, agents invoke anAWS Lambda-based market data service through the gateway, with Cedar policies enforcing deterministic access controls over tool usage and agent interactions.AgentCore memory maintains contextual state and reusable institutional knowledge across interactions. Session memory preserves conversation continuity, while a long-termprior_deals
namespace stores lessons from completed acquisitions that inform future analyses.AgentCore Evaluations, a capability of Amazon Bedrock AgentCore, uses Lambda-based evaluators to automatically validate output quality, citation accuracy, and domain-specific criteria. The citation-check evaluator returns a structured pass/fail result with counts of supported and unsupported claims.Amazon Bedrock Guardrailsenforces safety and response controls throughout the workflow, applied at the supervisor level so specialist outputs pass through organizational policy checks. Every invocation produces an Amazon CloudWatch log stream and an AWS X-Ray trace that captures the full supervisor-to-specialist-to-tool call hierarchy, providing end-to-end observability.
Security
M&A due diligence involves some of the most sensitive data a company handles: unreleased financials, deal terms, and integration plans. Security is therefore a first-class part of the architecture. Every IAM permission the agents can invoke is scoped to a specific Amazon Resource Name (ARN) rather than a wildcard. The AgentCore Gateway market-data tool goes a step further with a Cedar policy engine that enforces default-deny, attribute-based authorization. The tool runs only when the requested industry code matches an approved vertical. Everything else is denied before it runs. The database tier lives in private, internet-isolated subnets behind virtual private cloud (VPC) endpoints. Data stores are encrypted at rest with KMS, and Amazon Bedrock Guardrails screen every supervisor response for harmful content and personalized financial advice. This layered model of IAM, Cedar, network isolation, and encryption covers different failure modes for systems that handle confidential deal data.
Deploy and run the sample #
The complete reference implementation is available in the M&A Due Diligence Multi-Agent Sample repository. It ships with synthetic data (no real companies, financial data, or personally identifiable information), one-command deployment, and a Jupyter notebook walkthrough. The estimated cost for a full deploy-run-cleanup cycle is under USD $5.00.
Prerequisites
Before deploying, verify you have:
- An AWS account with Amazon Bedrock model access enabled for Anthropic Claude and Amazon Nova. For model availability by AWS Region, refer to Supported models by AWS Region in Amazon Bedrock. - AWS Command Line Interface (AWS CLI) v2.15 or later.
- Python 3.11 or later.
- Node.js 20 or later.
- AWS Cloud Development Kit (AWS CDK) v2 (
`npm install -g aws-cdk`
). - You don’t need Docker installed locally. The agent container image is built on AWS CodeBuild.
Deploy to one of the supported Regions: `us-east-1`
, `us-west-2`
, `ap-southeast-2`
, or `eu-central-1`
.
Step 1: Deploy the stack
Clone the repository and run the deploy script. First-time deployment takes 20–25 minutes.
The deploy script verifies your Region and model access, creates a virtual environment, runs cdk deploy --all
, seeds synthetic data, and executes a post-deploy smoke test. It also installs the project in editable mode, which registers the mna
command-line tool that you use to invoke agents in the next step.
Step 2: Invoke the agents
Use the mna CLI to send prompts to individual specialists or let the supervisor route across them:
Every invocation prints a trace_id
in its footer. Use mna trace <trace_id>
to inspect the full X-Ray trace for that call.
Step 3: Validate outputs with the evaluator
The mna evaluate subcommand runs the citation-check evaluator against a specialist’s output:
The evaluator returns a structured result indicating pass or failure, with counts of total claims, supported claims, and any unsupported assertions. The exit code is 0 on pass and 1 on fail, making it composable in CI pipelines.
Step 4: Explore the notebook
For a guided, cell-by-cell tour of the same workflow: The notebook walks through environment validation, data overview, one cell per specialist agent (with rendered responses and citations), and trace inspection.
Clean up #
To avoid ongoing charges, destroy all deployed resources as soon as you finish exploring:
The cleanup script runs cdk destroy --all --force
to tear down every stack in reverse dependency order. It then executes a verification sweep that scans for orphaned resources:
- S3 buckets matching
mna-*
. - ECR repositories matching mna-*.
- Amazon Bedrock Knowledge Bases with
mna
in the name. - AgentCore runtimes, memories, and gateways.
- AWS CloudFormation stacks starting with
Mna
.
The verification script prints copy-paste commands for resources it finds so you can confirm a zero-cost end state. If the script output is empty for every sweep, all billable resources have been removed. For additional details on CDK resource cleanup, see the AWS CDK documentation.
Next steps #
We encourage you to extend this architecture for your own use cases. Here are several paths forward:
Add a production front end. TheFull-Stack Starter Template for AgentCore (FAST)provides a React-based UI, Amazon Cognito authentication, and Amazon CloudFront distribution that integrates directly with AgentCore runtime.Build additional specialist agents. The sample’s CONTRIBUTING.md documents the file layout, Strands pattern, and supervisor registration process for adding new agents (for example, a regulatory-filing agent or an ESG-scoring agent).Explore advanced orchestration. TheStrands Agents SDKsupports multiple coordination approaches including agents-as-tools, swarms, and agent graphs. Themulti-agent collaboration patterns documentationcovers each approach in detail.Connect additional data sources. AgentCore Gateway supports HTTP APIs, MCP servers, and Amazon API Gateway targets beyond the single Lambda tool demonstrated here.
Conclusion #
In this post, we showed how to build a multi-agent system on Amazon Bedrock AgentCore that automates M&A due diligence in transportation and logistics. We walked through the architecture that coordinates specialized agents for target screening, financial analysis, strategic fit assessment, and compliance validation. We then deployed the working sample and invoked it against synthetic acquisition targets.
The reference implementation demonstrates how each architectural layer (agent orchestration, knowledge retrieval, structured data access, institutional memory, and automated evaluation) contributes to a system that is both capable and auditable. The patterns shown here extend naturally to other due diligence domains including healthcare, financial services, and technology acquisitions.
To get started, clone the sample repository, deploy the stack in your AWS account, and try modifying a specialist agent or adding a new one. The FAST template provides the path from this sample to a hosted application with authentication, observability, and a polished UI.
Resources #
Amazon Bedrock AgentCoreM&A Due Diligence Multi-Agent Sample– GitHub repository