{"slug": "aws-pluggable-agentic-ai-framework-seven-layers-for-bedrock-agentcore", "title": "AWS Pluggable Agentic AI Framework: Seven Layers for Bedrock AgentCore", "summary": "Amazon Web Services published a seven-layer Pluggable Agentic AI Framework on November 9, 2026, a reference architecture for running supervisor-plus-specialist agents on Amazon Bedrock AgentCore. The framework defines seven composable contracts spanning data and knowledge through agentic operations, with security hooks including AgentCore Identity, Policy, Guardrails and human approval, and ops hooks including OpenTelemetry traces and an AgentCore Evaluations regression gate. AWS shipped a companion workshop, aws-samples/sample-pluggable-agentic-ai-framework, that walks a fictional AnyCompany retailer through the design, and recommends a LiteLLM routing layer so model choice stays configuration rather than hardcoded agent logic.", "body_md": "**Amazon Web Services published a seven-layer Pluggable Agentic AI Framework on November 9, 2026**, aimed at teams whose agent demo works in a notebook but stalls when security, cost, and regression gates show up. The [AWS Machine Learning blog post](https://aws.amazon.com/blogs/machine-learning/pluggable-agentic-ai-framework-a-seven-layer-composable-enterprise-agentic-ai-reference-architecture-on-amazon-bedrock-agentcore/?ref=explainx) frames the gap as scaffolding every team rebuilds alone: custom routing, one-off guardrails, and observability wired after the fact.\n\nThe companion [sample-pluggable-agentic-ai-framework](https://github.com/aws-samples/sample-pluggable-agentic-ai-framework?ref=explainx) workshop walks a fictional **AnyCompany** retailer through supervisor-plus-specialist agents on [Amazon Bedrock AgentCore](https://aws.amazon.com/bedrock/agentcore/?ref=explainx). If you already read [CrossnoKaye's physical-AI case study](https://explainx.ai/blog/crossnokaye-aura-atlas-bedrock-agentcore-physical-ai-2026) from the same day, this post is the **horizontal blueprint** AWS wants every vertical to map onto.\n\n## TL;DR\n\n| Question | Answer | \n|---|---|\n| Published | November 9, 2026 | \n| Layers | 7 composable contracts from data through agentic ops | \n| Sample | `aws-samples/sample-pluggable-agentic-ai-framework` | \n| Orchestration | Supervisor plus specialists via Registry, MCP, and A2A | \n| Security hooks | AgentCore Identity, Policy, Guardrails, human approval | \n| Ops hooks | OpenTelemetry traces, AgentCore Evaluations regression gate | \n| Swap-friendly | LiteLLM routing, third-party observability named explicitly | \n\n## Why AWS split agents into seven layers\n\nProduction agent questions pile up faster than model capability improvements. AWS lists concurrent secure requests, silent failures under load, post-launch safety drift, and whether routing should stay deterministic. A POC answers none of that because it optimizes for a single successful trace, not SRE review.\n\nThe framework's design bet is **stable contracts between layers**. You should swap a vector database, model host, or tracing backend without rewriting orchestration logic, as long as each layer honors its interface. That mirrors how mature microservices separate API schemas from implementations, applied to agents that call tools and other agents.\n\nSeven layers of AWS Pluggable Agentic AI Framework from data and knowledge through agentic operations on Amazon Bedrock AgentCore\n*Image: [AWS](https://aws.amazon.com/blogs/machine-learning/pluggable-agentic-ai-framework-a-seven-layer-composable-enterprise-agentic-ai-reference-architecture-on-amazon-bedrock-agentcore/?ref=explainx)*\n\n## Layer 1: Data and Knowledge\n\nAgents need grounded context, whether the domain is healthcare formularies, warehouse inventory, or plant historians. This layer accepts a query and returns the best available structured or unstructured evidence.\n\nAWS examples include **Amazon Bedrock Knowledge Bases**, **OpenSearch Serverless** vector search, **S3 Vectors**, and **DynamoDB**. The contract is retrieval, not generation. That separation matters when you adopt patterns from our [Bedrock managed knowledge base agentic retrieval guide](https://explainx.ai/blog/bedrock-managed-knowledge-base-agentic-retrieval-agentcore-gateway-cdk-guide-2026), where gateway tools and RAG stay behind explicit tool calls.\n\n## Layer 2: Model and Inference\n\nModel choice should be configuration, not a hardcoded string buried inside agent code. AWS recommends evaluating models on **real business transcripts**, then installing a **routing layer** with a proxy such as **LiteLLM** so provider APIs look identical to the orchestrator.\n\nThat layer keeps agents decoupled from Bedrock versus third-party hosts. It also pairs with decision-model routing ideas in our [AgentCore Evaluations plus JEV screening guide](https://explainx.ai/blog/amazon-bedrock-agentcore-evaluations-decision-models-jev-strands-decider-screening-layer-guide-2026), where cheap classifiers decide whether the expensive agent loop should run at all.\n\n## Layer 3: Orchestration\n\nAWS draws a sharp line between **one agent for simple flows** and **supervisor plus specialists** for cross-domain work. It warns against a single agent accumulating every tool, which balloons context, raises latency, and invites tool misuse.\n\nSpecialists should stay **bounded**: only the tools they were granted. Supervisors discover specialists through a **centralized agent registry** and call them over **MCP** or **Agent2Agent (A2A)**. The post names **Strands Agents** for specialists and **Amazon Bedrock AgentCore Harness** for orchestration, plus **AgentCore Gateway** for centralized discovery.\n\nIf your team is standardizing on those protocols, our [A2A versus MCP explainer](https://explainx.ai/blog/what-is-a2a-agent2agent-protocol-mcp-comparison-guide-2026) and [AWS Agent Registry runtime discovery post](https://explainx.ai/blog/aws-agent-registry-runtime-tool-discovery-mcp-a2a-agentcore-sample-guide-2026) cover the same contracts with different sample topologies.\n\nRetail customer support supervisor and specialist agents on AWS Pluggable Agentic AI reference implementation\n*Image: [AWS](https://aws.amazon.com/blogs/machine-learning/pluggable-agentic-ai-framework-a-seven-layer-composable-enterprise-agentic-ai-reference-architecture-on-amazon-bedrock-agentcore/?ref=explainx)*\n\n## Layer 4: Security and Guardrails\n\nAgentic systems introduce prompt injection, tool misuse, and memory poisoning risks that classic app firewalls were not built to catch. AWS treats **all external content as untrusted**, authenticates every caller (human, agent, or automation) through **AgentCore Identity**, and enforces **fine-grained access control** before a tool executes.\n\nData protection includes masking PHI and PII in flight, issuing **temporary scoped credentials** instead of long-lived secrets, and logging tamper-evident decisions. High-impact actions should pass **human approval gates**, with **circuit breakers** to halt anomalous loops. **Amazon Bedrock Guardrails** sit on user inputs; **Policy in AgentCore** backs authorization.\n\nFor builders wiring coding agents, pair this layer with our [Claude Code remote sessions on AgentCore security sample](https://explainx.ai/blog/claude-code-remote-sessions-bedrock-agentcore-security-controls-sample-2026) and the **Trust in Depth** framing in [AWS scope, know, bound, observe](https://explainx.ai/blog/aws-trust-in-depth-agent-autonomy-scope-know-bound-observe-agentcore-policy-2026). When agents can chain dozens of tool calls autonomously, add runtime checks from [AgentBeam](https://agentbeam.com/?ref=explainx) so dangerous actions are blocked before they leave the sandbox, not after logs show damage.\n\n## Layer 5: Application\n\nThe user-facing surface, chat UI, API, or embedded widget, should stay thin. It renders conversation state and forwards requests downward. AWS discourages embedding business rules here because UI iteration should not destabilize backend agents.\n\nThe post also recommends a **decision model** at the boundary: a fast, inexpensive classifier that scores whether a request is in scope, needs a human, or is urgent, returning probabilities your code thresholds, not free text. That pattern reduces cost before the full supervisor loop spins up.\n\n## Layer 6: Observability\n\nAWS wants **end-to-end agent traces** from day one, not after the first production incident. Metrics include token spend per request, time to first token, security signals, latency, and error rates on dashboards before launch.\n\nThe reference stack cites **Amazon CloudWatch** with **OpenTelemetry** and **CloudWatch Omni**. That aligns with how [Greenlight's autonomous SOC story](https://explainx.ai/blog/greenlight-luna-autonomous-soc-bedrock-agentcore-83-percent-autonomous-2026) used AgentCore observability for auditable automation, even though the domain differs.\n\n## Layer 7: Agentic Operations\n\nShipping is not the finish line. AWS recommends scoring live sessions for groundedness, accuracy, and safety, then running a **regression gate** before the next release. **Amazon Bedrock AgentCore Evaluations** supplies scoring; optimization tooling supports continuous tuning.\n\nWithout this layer you only know the agent worked on launch day. With it you can defend SLAs when models, tools, or prompts change weekly.\n\n## Retail reference flow in the workshop repo\n\nThe blog's second figure traces a **refund eligibility** path. A supervisor receives the shopper message and delegates to an **Order agent** and a **Refund agent**. The order specialist reads DynamoDB for delivery facts. The refund specialist queries a knowledge base for tier rules and computes eligibility from dates and loyalty tier.\n\nEvery tool call routes through **AgentCore Gateway**, which enforces policy before execution, and through the observability layer so a wrong refund calculation traces to the exact decision point. AWS says teams can clone the pattern and swap domain logic layer by layer.\n\nThe GitHub workshop README maps those pieces to concrete services: **AgentCore Harness** orchestrator, **Registry** discovery, **Gateway** MCP tools hitting Lambda and a knowledge base, plus **Memory** for short and long horizon state. It repeats that the repo is **sample educational code** requiring security review, IAM hardening, monitoring, and error handling before customer traffic.\n\n## How this fits next to other AgentCore samples\n\nAWS now maintains multiple public samples with overlapping ideas. This November framework emphasizes **pluggability contracts**; the [multi-agent concierge repository](https://github.com/aws-samples/sample-multi-agent-on-agentcore?ref=explainx) stresses IAM RBAC on DynamoDB leading keys; [agentcore-samples](https://github.com/awslabs/agentcore-samples?ref=explainx) catalogs feature deep dives per capability.\n\nPick one sample as a spine, then import layers from the others. Registry discovery from October aligns with this November supervisor diagram. Evaluations guidance from our [Bedrock AgentCore Evaluations post](https://explainx.ai/blog/amazon-bedrock-agentcore-evaluations-decision-models-jev-strands-decider-screening-layer-guide-2026) supplies the regression gate the framework names but does not fully implement inside the retail workshop.\n\n## What builders should copy this week\n\nIf you are moving from a successful internal demo to a pilot, walk the seven layers as a checklist rather than a shopping list.\n\n1. **Freeze contracts.** Write what each layer must accept and return before picking products. Model swaps become configuration when inference APIs stay stable.\n2. **Split specialists early.** Give each agent a narrow tool allow list and register skills in AgentCore Registry so supervisors stop hardcoding endpoints.\n3. **Put identity on the critical path.** Agent-to-agent calls need the same rigor as user SSO. Start with AgentCore Identity plus Policy, then add Guardrails on untrusted text.\n4. **Ship traces before features.** OpenTelemetry spans across supervisor, specialist, and tool layers make debugging cheaper than replaying prompts in chat logs.\n5. **Gate releases with evals.** Store baseline scores from AgentCore Evaluations and block deploys when groundedness or safety drops, even if latency improved.\n\nEnterprise buyers evaluating **ChatGPT Enterprise on AWS Marketplace** should read our [November marketplace integration post](https://explainx.ai/blog/chatgpt-enterprise-aws-marketplace-november-2026) for procurement context, then map third-party chat surfaces onto the same AgentCore layers instead of duplicating security silos.\n\n## Limits AWS states openly\n\nThe framework is **reference architecture**, not a managed product SKU. Teams must still choose tenancy models, data residency, and cost caps. Third-party integrations named in the post are examples; AWS does not certify them for your compliance regime.\n\nThe workshop warns against production deployment without review. That is not modesty, it is accurate: sample IAM policies, demo Cognito pools, and simplified refund rules will not survive a hostile prompt injection review without hardening.\n\nPluggability also shifts responsibility. When you can swap LiteLLM routes or observability vendors quickly, **your team** owns regression testing across those swaps. The seven layers give you insertion points; they do not remove the need for red teams and load tests.\n\n## Related reading\n\n- [CrossnoKaye AURA on AgentCore in industrial plants](https://explainx.ai/blog/crossnokaye-aura-atlas-bedrock-agentcore-physical-ai-2026) — November 9 case study using the same AgentCore stack this framework generalizes\n- [AWS Agent Registry runtime MCP and A2A discovery](https://explainx.ai/blog/aws-agent-registry-runtime-tool-discovery-mcp-a2a-agentcore-sample-guide-2026)\n- [AWS Trust in Depth for agent autonomy](https://explainx.ai/blog/aws-trust-in-depth-agent-autonomy-scope-know-bound-observe-agentcore-policy-2026)\n- [Bedrock AgentCore Web Answer GA guide](https://explainx.ai/blog/amazon-bedrock-agentcore-web-answer-ga-single-tool-call-cited-answers-gateway-setup-guide-2026)\n- [Amazon Quick agentic primitives taxonomy](https://explainx.ai/blog/amazon-quick-agentic-primitives-taxonomy-triggers-agents-capabilities-learned-context-2026)\n- [A2A protocol versus MCP comparison](https://explainx.ai/blog/what-is-a2a-agent2agent-protocol-mcp-comparison-guide-2026)\n- [Claude Code remote sessions security on AgentCore](https://explainx.ai/blog/claude-code-remote-sessions-bedrock-agentcore-security-controls-sample-2026)", "url": "https://wpnews.pro/news/aws-pluggable-agentic-ai-framework-seven-layers-for-bedrock-agentcore", "canonical_source": "https://explainx.ai/blog/aws-pluggable-agentic-ai-framework-bedrock-agentcore-seven-layers-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog", "published_at": "2026-11-09 00:00:00+00:00", "updated_at": "2026-11-09 23:50:57.012674+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "agent-protocols", "ai-tools", "artificial-intelligence"], "entities": ["Amazon Web Services", "Amazon Bedrock AgentCore", "LiteLLM", "OpenTelemetry", "AnyCompany", "Amazon Bedrock Knowledge Bases", "OpenSearch Serverless", "DynamoDB"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/aws-pluggable-agentic-ai-framework-seven-layers-for-bedrock-agentcore", "markdown": "https://wpnews.pro/news/aws-pluggable-agentic-ai-framework-seven-layers-for-bedrock-agentcore.md", "text": "https://wpnews.pro/news/aws-pluggable-agentic-ai-framework-seven-layers-for-bedrock-agentcore.txt", "jsonld": "https://wpnews.pro/news/aws-pluggable-agentic-ai-framework-seven-layers-for-bedrock-agentcore.jsonld"}}