Agentic AI on AWS for the AIF-C01

Part 5 of 6 in the AIF-C01 exam prep series for developers. Previous: Domain 3: Applications of Foundation Models.

Agentic AI is the headline of the 2026 exam refresh. In the original guide it was a single mention of Amazon Bedrock Agents. In v1.1 it runs through four of the five domains, with a brand-new objective dedicated to agent concepts and four newly in-scope services. Most prep courses were recorded before any of this, so this is the post that closes the biggest gap.

Unlike the other posts, this one isn't organized by domain. It teaches agents once, end to end, and the domain posts link here.

Where agentic AI appears in the exam#

What makes an agent#

A chatbot takes a prompt and returns text. An agent takes a goal and works toward it. It uses a model to decide what to do next, calls tools to do it, looks at the result, and repeats until the goal is met.

Every agent has four ingredients plus a loop:

Figure: The agent loop. The model decides the steps, which is what separates an agent from a fixed workflow. This pattern is often called ReAct (reason plus act).

Agent, chatbot, RAG, or workflow?#

The exam's most common agentic question is really a classification question: does this scenario need an agent at all?

Tools#

A tool is a function the agent can call, described by a schema: a name, a description of what it does, and its parameters. The model reads those descriptions to decide which tool to call and with what arguments. That makes tool descriptions part of the prompt. Vague descriptions cause wrong tool choices.

On AWS, tools are typically backed by:

• AWS Lambda functions
• REST APIs described with OpenAPI
• MCP servers
• built-in capabilities such as a code interpreter or a web browser

Tool results feed back into the loop, and a failed call is information the model can reason about and recover from.

Human-in-the-loop fits naturally here: for high-impact actions, the agent pauses and returns control to a person for approval before executing.

MCP: connecting agents to external systems#

The Model Context Protocol (MCP) is an open standard, introduced by Anthropic and now widely adopted, including by AWS, for connecting agents to external tools and data.

• Hosts, clients, and servers. An agent application (the host) runs MCP clients. Each client connects to an MCP server.
• What a server exposes: tools (actions), resources (data), and prompts (reusable templates).
• The problem it solves. Without a standard, connecting M agents to N systems means M × N custom integrations. With MCP, each side implements the protocol once: M + N.

Figure: MCP standardizes how agents reach tools. AgentCore Gateway turns existing Lambda functions and APIs into MCP tools without rewriting them.

Agent-to-Agent (A2A) is the complementary protocol for agents talking to other agents, including across vendors. Agents publish an "Agent Card" describing their capabilities, so others can discover them and delegate work.

Memory management#

Memory is not a knowledge base.

• Knowledge Bases hold organizational knowledge: shared, curated, and updated in batches.
• Memory holds interaction state: usually scoped to one user and written continuously as the agent works.

Context engineering#

Objective 2.1.5 is new, and the distinction it rests on is narrow but real.

• Prompt engineering is writing a better instruction.
• Context engineering is deciding everything that occupies the model's context window at each step: system prompt, retrieved documents, conversation history, tool definitions, tool results, and memory.

Prompt engineering is a subset of it.

It matters because context is scarce and expensive, and agents are especially hungry for it. Every loop iteration re-sends a growing context, so:

• Cost rises with every token (see token pricing in Post 3).
• Latency rises, because longer input means a slower first token.
• Quality eventually falls. Relevant details get buried in noise before you hit the hard token limit, a failure sometimes called context rot.

Techniques:

Multi-agent patterns and orchestration#

Figure: Three multi-agent shapes: central delegation, peer hand-offs, and a fixed path.

Communication patterns follow from the shape:

• Hierarchical delegation: the supervisor sends tasks down and gets results back.
• Peer hand-off: agents pass control and context to each other.
• Shared state: agents read and write a common memory.
• Protocol-based messaging: A2A, for agents across systems or vendors.

Workflow orchestration is the control layer that decides who runs when, passes context between steps, and handles retries, time limits, and stopping.

Why split into multiple agents?

• Smaller, focused contexts improve tool selection.
• Each agent gets its own permissions.
• Parts can be developed and scaled independently.
• Simple roles can run on cheaper models.

Why not? Every hand-off adds latency and cost, and can lose context. Debugging gets harder. Start with one agent; split only when tool selection degrades or when trust boundaries genuinely differ.

Building agents on AWS#

AWS's agent stack has distinct layers, and many exam questions test whether you can tell them apart.

Figure: Strands is how the agent thinks. AgentCore is where it runs and how it's governed. The model is the brain it borrows. Kiro, Quick, and Transform are finished agentic products.

Strands Agents#

Strands Agents is an open-source SDK (Apache 2.0, for Python and TypeScript) created by AWS for building agents in code. Its philosophy is model-driven: you provide a model, a system prompt, and tools, and the model drives its own loop, rather than you hardcoding a flowchart.

• Tools: any Python function becomes a tool with the @tool decorator, and MCP servers plug in directly.
• Model-agnostic: Amazon Bedrock by default, and also Anthropic, OpenAI, and others.
• Runs anywhere: your laptop, AWS Lambda, containers, or AgentCore Runtime.
• Multi-agent built in: agents as tools, swarm, graph, and workflow.
• Observability: emits OpenTelemetry traces.

Here's the smallest meaningful agent: a model, instructions, and one tool.

from strands import Agent, tool

@tool
def get_order_status(order_id: str) -> str:
    """Look up the current shipping status of a customer order.

    Args:
        order_id: The order identifier, for example "A-1042".
    """
    return orders_db.lookup(order_id)  # your real system goes here

agent = Agent(
    system_prompt="You are a support agent. Check facts with tools; never guess.",
    tools=[get_order_status],  # the model decides when to call this
)                              # the model defaults to one on Amazon Bedrock

agent("Where is my order A-1042?")

Illustrative only; the exam never asks you to read code. The docstring is the tool description the model reads when choosing tools.

Amazon Bedrock AgentCore#

AgentCore is a managed platform for running agents securely at scale. Three properties come up repeatedly:

• Framework-agnostic: Strands, LangGraph, CrewAI, LlamaIndex, and others.
• Model-agnostic: models inside or outside Bedrock.
• Composable: each service works on its own or together with the others.

Figure: How AgentCore's services fit together around a running agent. Policy sits in front of every tool call, outside the agent's own reasoning.

Bedrock Agents Classic#

Amazon Bedrock Agents, the original managed agent service from 2023, is now Bedrock Agents Classic. It's in maintenance mode and closed to new customers from July 30, 2026. Existing workloads keep running, and AWS recommends migrating to AgentCore; the AgentCore Harness is the closest equivalent.

Its concepts are still worth knowing because they reappear generically:

• Instructions: the agent's role, in natural language.
• Action groups: tools defined by OpenAPI schemas or function definitions, executed by Lambda.
• Knowledge bases: attached for RAG.
• Orchestration: the model plans steps and executes them.
• Traces: show each reasoning step and tool call.

Agentic services you use rather than build#

Business applications of agents#

The common thread is multi-step work that crosses systems and requires decisions along the way. If the steps never vary, a workflow is cheaper and more predictable. If nothing needs to change in any system, RAG is enough.

Evaluating agents#

An agent can produce a good final answer by a wasteful or dangerous path. So agent evaluation looks at the trajectory, not just the output:

On AWS:

• AgentCore Observability captures every step.
• AgentCore Evaluations scores sessions, traces, and tool calls, on demand or continuously.
• Optimization proposes and A/B-tests improvements.

Securing agents#

An agent can do things, so its security model goes beyond content filtering. Know which layer controls what:

AgentCore Identity handles two directions:

• Inbound: is this user or app allowed to invoke the agent?
• Outbound: the agent needs to call a third-party service, such as Google Calendar, as a specific user. Identity brokers that user's OAuth tokens from a secure vault, so the agent never holds long-lived credentials and can only do what that user is allowed to do.

Agent-specific risks to be able to name:

Commonly confused#

Practice questions#

Q1 (ordering). Put the steps of a single-agent loop in order.

• A. Observe the tool's result
• B. Reason about the goal and plan the next step
• C. Return the final answer
• D. Call the selected tool
• E. Receive the user's goal

Q2 (matching). Match each requirement to the AgentCore service that meets it.

Services: Memory, Policy, Runtime, Identity, Gateway.

Q3. A company wants its agents to connect to many internal and third-party systems through a single open standard, so each integration is built once and reused by any agent. What should they use?

• A. Agent-to-Agent (A2A) protocol
• B. Model Context Protocol (MCP)
• C. Amazon Bedrock Flows
• D. Amazon Bedrock Knowledge Bases

Q4. A development team wants an open-source SDK to define an agent's model, instructions, and tools in Python, and to be able to run it locally or on AWS. What should they use?

• A. Amazon Bedrock AgentCore Runtime
• B. Strands Agents
• C. Amazon Quick
• D. Kiro

Q5. A marketing manager with no coding experience wants to analyze campaign data, research competitors across company documents, and automate a weekly summary report. Which service fits best?

• A. Kiro
• B. Strands Agents
• C. Amazon Quick
• D. Amazon SageMaker AI

Q6. A support agent performs well in short tests. In production, long conversations make it slower, more expensive, and less accurate, and with 60 available tools it often calls the wrong one. What is the best approach?

• A. Switch to a larger model with a bigger context window
• B. Apply context engineering: summarize older turns, curate the tools exposed per task, and retrieve only relevant context
• C. Increase the temperature
• D. Fine-tune the model on past conversations

Q7. An airline's customer service agent can issue refunds through a tool. The business rule is that the agent must never issue a refund above 500 USD, and the rule must hold even if the model is manipulated. Which control fits best?

• A. Add the rule to the agent's system prompt
• B. Bedrock Guardrails denied topics
• C. Policy in Amazon Bedrock AgentCore
• D. A larger, more capable model

Q8. An agent summarizes customer documents. One document contains hidden text instructing the agent to email its tool credentials to an external address. What kind of attack is this, and which mitigation is most effective?

• A. Jailbreaking; use a higher temperature
• B. Indirect prompt injection; enforce least privilege and authorize actions outside the model, for example with AgentCore Policy
• C. Data poisoning; retrain the model
• D. Model inversion; encrypt the documents

Q9. A bank is automating loan processing with several agents: document extraction, validation, risk scoring, and approval. Regulators require the same auditable sequence for every application. Which multi-agent pattern fits best?

• A. Swarm
• B. Supervisor with dynamic delegation
• C. Graph / workflow
• D. A single agent with all tools

Key takeaways#

• An agent is a model plus instructions, tools, and memory, running in a loop. GenAI creates; agents act.
• Use the simplest pattern that works: plain call → RAG (read-only) → workflow (fixed steps) → agent (model decides and acts) → multi-agent.
• MCP connects agents to tools. A2A connects agents to agents.
• Memory holds interaction state; Knowledge Bases hold organizational knowledge.
• Context engineering manages everything in the context window. It's the fix for agents that degrade over long sessions or have too many tools.
• Multi-agent patterns: supervisor for departments, swarm for exploration, graph for auditability.
• Strands builds the agent; AgentCore runs and governs it; Bedrock provides the model. Bedrock Agents is now Agents Classic.
• Kiro is for developers, Quick is for business users, Transform is for legacy modernization.
• Evaluate the trajectory, not just the answer: AgentCore Observability plus Evaluations.
• Security layers: Guardrails for what agents say, Policy for what they do, IAM for what they can touch, Identity for whose behalf they act on.

Next: Domains 4 + 5: Responsible AI, Security, and Governance.

Sources#

• AIF-C01 exam guide and revisions
• What is Amazon Bedrock AgentCore?
• AgentCore harness
• AgentCore Gateway and Policy in AgentCore permissions
• Amazon Bedrock Agents Classic maintenance mode
• Strands Agents documentation
• Model Context Protocol
• Kiro
• AWS service availability updates, June 30, 2026