Amazon Web Services published a seven-layer Pluggable Agentic AI Framework on November 9, 2026, aimed at teams whose agent demo works in a notebook but stalls when security, cost, and regression gates show up. The AWS Machine Learning blog post frames the gap as scaffolding every team rebuilds alone: custom routing, one-off guardrails, and observability wired after the fact.
The companion sample-pluggable-agentic-ai-framework workshop walks a fictional AnyCompany retailer through supervisor-plus-specialist agents on Amazon Bedrock AgentCore. If you already read CrossnoKaye's physical-AI case study from the same day, this post is the horizontal blueprint AWS wants every vertical to map onto.
TL;DR #
| Question | Answer |
|---|---|
| Published | November 9, 2026 |
| Layers | 7 composable contracts from data through agentic ops |
| Sample | aws-samples/sample-pluggable-agentic-ai-framework |
| Orchestration | Supervisor plus specialists via Registry, MCP, and A2A |
| Security hooks | AgentCore Identity, Policy, Guardrails, human approval |
| Ops hooks | OpenTelemetry traces, AgentCore Evaluations regression gate |
| Swap-friendly | LiteLLM routing, third-party observability named explicitly |
Why AWS split agents into seven layers #
Production agent questions pile up faster than model capability improvements. AWS lists concurrent secure requests, silent failures under load, post-launch safety drift, and whether routing should stay deterministic. A POC answers none of that because it optimizes for a single successful trace, not SRE review.
The framework's design bet is stable contracts between layers. You should swap a vector database, model host, or tracing backend without rewriting orchestration logic, as long as each layer honors its interface. That mirrors how mature microservices separate API schemas from implementations, applied to agents that call tools and other agents.
Seven layers of AWS Pluggable Agentic AI Framework from data and knowledge through agentic operations on Amazon Bedrock AgentCore Image: AWS
Layer 1: Data and Knowledge #
Agents need grounded context, whether the domain is healthcare formularies, warehouse inventory, or plant historians. This layer accepts a query and returns the best available structured or unstructured evidence.
AWS examples include Amazon Bedrock Knowledge Bases, OpenSearch Serverless vector search, S3 Vectors, and DynamoDB. The contract is retrieval, not generation. That separation matters when you adopt patterns from our Bedrock managed knowledge base agentic retrieval guide, where gateway tools and RAG stay behind explicit tool calls.
Layer 2: Model and Inference #
Model choice should be configuration, not a hardcoded string buried inside agent code. AWS recommends evaluating models on real business transcripts, then installing a routing layer with a proxy such as LiteLLM so provider APIs look identical to the orchestrator.
That layer keeps agents decoupled from Bedrock versus third-party hosts. It also pairs with decision-model routing ideas in our AgentCore Evaluations plus JEV screening guide, where cheap classifiers decide whether the expensive agent loop should run at all.
Layer 3: Orchestration #
AWS draws a sharp line between one agent for simple flows and supervisor plus specialists for cross-domain work. It warns against a single agent accumulating every tool, which balloons context, raises latency, and invites tool misuse.
Specialists should stay bounded: only the tools they were granted. Supervisors discover specialists through a centralized agent registry and call them over MCP or Agent2Agent (A2A). The post names Strands Agents for specialists and Amazon Bedrock AgentCore Harness for orchestration, plus AgentCore Gateway for centralized discovery.
If your team is standardizing on those protocols, our A2A versus MCP explainer and AWS Agent Registry runtime discovery post cover the same contracts with different sample topologies. Retail customer support supervisor and specialist agents on AWS Pluggable Agentic AI reference implementation Image: AWS
Layer 4: Security and Guardrails #
Agentic systems introduce prompt injection, tool misuse, and memory poisoning risks that classic app firewalls were not built to catch. AWS treats all external content as untrusted, authenticates every caller (human, agent, or automation) through AgentCore Identity, and enforces fine-grained access control before a tool executes.
Data protection includes masking PHI and PII in flight, issuing temporary scoped credentials instead of long-lived secrets, and logging tamper-evident decisions. High-impact actions should pass human approval gates, with circuit breakers to halt anomalous loops. Amazon Bedrock Guardrails sit on user inputs; Policy in AgentCore backs authorization.
For builders wiring coding agents, pair this layer with our Claude Code remote sessions on AgentCore security sample and the Trust in Depth framing in AWS scope, know, bound, observe. When agents can chain dozens of tool calls autonomously, add runtime checks from AgentBeam so dangerous actions are blocked before they leave the sandbox, not after logs show damage.
Layer 5: Application #
The user-facing surface, chat UI, API, or embedded widget, should stay thin. It renders conversation state and forwards requests downward. AWS discourages embedding business rules here because UI iteration should not destabilize backend agents.
The post also recommends a decision model at the boundary: a fast, inexpensive classifier that scores whether a request is in scope, needs a human, or is urgent, returning probabilities your code thresholds, not free text. That pattern reduces cost before the full supervisor loop spins up.
Layer 6: Observability #
AWS wants end-to-end agent traces from day one, not after the first production incident. Metrics include token spend per request, time to first token, security signals, latency, and error rates on dashboards before launch.
The reference stack cites Amazon CloudWatch with OpenTelemetry and CloudWatch Omni. That aligns with how Greenlight's autonomous SOC story used AgentCore observability for auditable automation, even though the domain differs.
Layer 7: Agentic Operations #
Shipping is not the finish line. AWS recommends scoring live sessions for groundedness, accuracy, and safety, then running a regression gate before the next release. Amazon Bedrock AgentCore Evaluations supplies scoring; optimization tooling supports continuous tuning.
Without this layer you only know the agent worked on launch day. With it you can defend SLAs when models, tools, or prompts change weekly.
Retail reference flow in the workshop repo #
The blog's second figure traces a refund eligibility path. A supervisor receives the shopper message and delegates to an Order agent and a Refund agent. The order specialist reads DynamoDB for delivery facts. The refund specialist queries a knowledge base for tier rules and computes eligibility from dates and loyalty tier.
Every tool call routes through AgentCore Gateway, which enforces policy before execution, and through the observability layer so a wrong refund calculation traces to the exact decision point. AWS says teams can clone the pattern and swap domain logic layer by layer.
The GitHub workshop README maps those pieces to concrete services: AgentCore Harness orchestrator, Registry discovery, Gateway MCP tools hitting Lambda and a knowledge base, plus Memory for short and long horizon state. It repeats that the repo is sample educational code requiring security review, IAM hardening, monitoring, and error handling before customer traffic.
How this fits next to other AgentCore samples #
AWS now maintains multiple public samples with overlapping ideas. This November framework emphasizes pluggability contracts; the multi-agent concierge repository stresses IAM RBAC on DynamoDB leading keys; agentcore-samples catalogs feature deep dives per capability.
Pick one sample as a spine, then import layers from the others. Registry discovery from October aligns with this November supervisor diagram. Evaluations guidance from our Bedrock AgentCore Evaluations post supplies the regression gate the framework names but does not fully implement inside the retail workshop.
What builders should copy this week #
If you are moving from a successful internal demo to a pilot, walk the seven layers as a checklist rather than a shopping list.
- Freeze contracts. Write what each layer must accept and return before picking products. Model swaps become configuration when inference APIs stay stable.
- Split specialists early. Give each agent a narrow tool allow list and register skills in AgentCore Registry so supervisors stop hardcoding endpoints.
- Put identity on the critical path. Agent-to-agent calls need the same rigor as user SSO. Start with AgentCore Identity plus Policy, then add Guardrails on untrusted text.
- Ship traces before features. OpenTelemetry spans across supervisor, specialist, and tool layers make debugging cheaper than replaying prompts in chat logs.
- Gate releases with evals. Store baseline scores from AgentCore Evaluations and block deploys when groundedness or safety drops, even if latency improved.
Enterprise buyers evaluating ChatGPT Enterprise on AWS Marketplace should read our November marketplace integration post for procurement context, then map third-party chat surfaces onto the same AgentCore layers instead of duplicating security silos.
Limits AWS states openly #
The framework is reference architecture, not a managed product SKU. Teams must still choose tenancy models, data residency, and cost caps. Third-party integrations named in the post are examples; AWS does not certify them for your compliance regime.
The workshop warns against production deployment without review. That is not modesty, it is accurate: sample IAM policies, demo Cognito pools, and simplified refund rules will not survive a hostile prompt injection review without hardening.
Pluggability also shifts responsibility. When you can swap LiteLLM routes or observability vendors quickly, your team owns regression testing across those swaps. The seven layers give you insertion points; they do not remove the need for red teams and load tests.
Related reading #
- CrossnoKaye AURA on AgentCore in industrial plants — November 9 case study using the same AgentCore stack this framework generalizes
- [AWS Agent Registry runtime MCP and A2A discovery](https://explainx.ai/blog/aws-agent-registry-runtime-tool-discovery-mcp-a2a-agentcore-sample-guide-2026)
- [AWS Trust in Depth for agent autonomy](https://explainx.ai/blog/aws-trust-in-depth-agent-autonomy-scope-know-bound-observe-agentcore-policy-2026)
- [Bedrock AgentCore Web Answer GA guide](https://explainx.ai/blog/amazon-bedrock-agentcore-web-answer-ga-single-tool-call-cited-answers-gateway-setup-guide-2026)
- [Amazon Quick agentic primitives taxonomy](https://explainx.ai/blog/amazon-quick-agentic-primitives-taxonomy-triggers-agents-capabilities-learned-context-2026)
- [A2A protocol versus MCP comparison](https://explainx.ai/blog/what-is-a2a-agent2agent-protocol-mcp-comparison-guide-2026)
- [Claude Code remote sessions security on AgentCore](https://explainx.ai/blog/claude-code-remote-sessions-bedrock-agentcore-security-controls-sample-2026)