Agents Choose When; Step Functions Keeps the Workflow’s Steps

AWS on October 29 announced that existing Standard and Express Step Functions workflows can be invoked as tools through Amazon Bedrock AgentCore Gateway, with the agent choosing whether to invoke a workflow and what input to pass while the configured state machine determines which steps run and in what order. The connector documentation lists ten operations: StartExecution, StartSyncExecution, ListExecutions and DescribeStateMachine are pinned to a state machine, while DescribeExecution, StopExecution, GetExecutionHistory, SendTaskSuccess, SendTaskFailure and SendTaskHeartbeat accept an execution ARN or task token; StartSyncExecution is Express-only, and ListExecutions, DescribeExecution, StopExecution and GetExecutionHistory are Standard-only. The gateway and state machine must sit in the same AWS Region, and the launch carries two meters: Step Functions charges $0.000025 per Standard state transition after a 4,000-transition monthly free tier in US East (N. Virginia), while AgentCore Gateway charges $0.005 per 1,000 API invocations plus $0.02 per 100 tools indexed monthly.

AWS has made existing Standard and Express Step Functions workflows callable as tools through Amazon Bedrock AgentCore Gateway, an agent gateway https://forkast.news/glossary/agent-gateway/ . The key design boundary is simple but consequential: an agent chooses whether to invoke a workflow and what input to pass; the configured state machine determines which steps run and in what order. The connector’s two jobs In its October 29 announcement https://aws.amazon.com/about-aws/whats-new/2026/10/step-functions-workflows-ai-agent-tools/ , AWS describes using existing Standard and Express workflows as agent tools. The gateway exposes workflow operations to an agent; Step Functions runs the state machine as configured. This creates an action boundary, not a way for a model to rewrite the business process while it runs. The connector documentation https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-connector-step-functions.html lists ten operations. Four are pinned to a state machine: StartExecution, StartSyncExecution, ListExecutions and DescribeStateMachine. Six accept an execution ARN or task token: DescribeExecution, StopExecution, GetExecutionHistory, SendTaskSuccess, SendTaskFailure and SendTaskHeartbeat. StartExecution works with both Standard and Express; StartSyncExecution is Express-only. ListExecutions, DescribeExecution, StopExecution and GetExecutionHistory are Standard-only. The .waitForTaskToken callback pattern is supported only by Standard workflows, not Express; it is a workflow pattern, not a connector operation. The connector exposes related callback actions through SendTaskSuccess, SendTaskFailure and SendTaskHeartbeat. The split matters because exposing a workflow is not the same as exposing every possible operation on every run. Workflow type and deployment boundaries Standard and Express are both supported for starting workflows, but the operation set is not identical across them. A builder planning to let an agent inspect runs needs to choose a Standard workflow and match the exposed operations to the job. There is also a regional boundary. AWS’s setup tutorial https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-agentcore-gateway.html says the gateway and state machine must be in the same AWS Region; the connector cannot reach a state machine in another Region. The connector uses a gateway service role. AWS documents separate IAM resource scopes for state-machine operations, execution operations and task-token operations; the last require wildcard resource permissions. That makes the choice of exposed operations and permissions part of integration design. Two bills, not one The launch carries both services’ standard charges. Step Functions pricing https://aws.amazon.com/step-functions/pricing/ meters Standard workflows by state transitions, including retries, while Express pricing is based on requests, duration and memory. The pricing page’s US East N. Virginia example uses $0.000025 per Standard transition after the monthly 4,000-transition free tier. AgentCore Gateway pricing https://aws.amazon.com/bedrock/agentcore/pricing/ adds its own meter: $0.005 per 1,000 API invocations, with tool indexing billed separately at $0.02 per 100 tools indexed monthly. The launch is therefore not priced as a single workflow call. Builders need to account for the gateway operation and the underlying workflow’s own execution meter. What builders are actually handing over This is useful when an agent needs to initiate a process already encoded as a state machine. The agent can select the invocation and provide input; the workflow’s predefined sequence remains the execution contract. The connector does not by itself make an approval safe or guarantee every outcome complies with policy. Those depend on the workflow and surrounding controls, not merely on an agent being able to call it. The practical question is which operations the agent needs, what each can address, and whether workflow type, Region, permissions and separate cost meters fit the intended use. AgentCore Gateway supplies the tool interface; Step Functions keeps the steps.