AWS describes Trust in Depth as a set of independent, reinforcing layers for governing agents: Scope before execution, Know at deployment, Bound during execution and Observe after each run. Proof supports these layers wherever rules can be stated precisely. Content filtering, testing or monitoring alone, the article argues, cannot guarantee correct behavior on the next run.

An agent may choose different tools and execution paths for the same task. Requiring human approval for every action can create bottlenecks and review fatigue. AWS recommends autonomous action where actions can be verified, reserving human judgment for ambiguity. Autonomy should expand as evidence establishes rule enforcement, task reliability and failure handling.

Define responsibilities and establish identity

Scope covers an agent's responsibilities, accessible tools, data and services, governing rules and decisions reserved for people. AWS recommends granting only necessary access and checking permissions bundled with tools or roles. It describes Kiro as converting intent into structured requirements, using automated reasoning to find contradictions, ambiguities and gaps, and deriving property-based tests. Strands is described as an open-source toolkit for defining models, instructions and tools, alongside a managed runtime.

According to AWS, Policies in Amazon Bedrock AgentCore lets users describe permitted tools, APIs and data in plain language, then checks for excessive access and contradictions before policies take effect. Agent Registry is presented as a managed catalog of approved agents, MCP servers, tools and skills. Administrator workflows control approval, discoverability and removal, while people and agents can discover and reuse entries. AWS says AgentCore assigns each agent its own identity and checks it on every request to associate actions with the agent and its authority.

Enforce boundaries outside the agent

The article recommends evaluating complete action sequences: individually permitted steps can combine into a prohibited outcome. AWS says Policy in AgentCore enforces rules independently of the agent's reasoning on every tool call routed through AgentCore Gateway. Temporal policies consider session history and adjust permissions as work proceeds. The enforcement described applies to calls passing through that gateway.

AWS describes Amazon Bedrock Guardrails as filtering harmful or off-topic inputs and outputs and redacting sensitive data. Automated Reasoning checks are described as proving response consistency with a specified policy. Strands Box provides, according to AWS, an open-source sandbox that enforces permitted file, service and credential access outside agent instructions, with the same boundaries from local development through production.

Proof has a defined scope. Automated reasoning checks precise rules across every path covered by a system description and its assumptions, producing either a proof or a failing case. The article stresses that this does not cover contextual expectations such as a friendly tone. A proof therefore concerns the specified rules and assumptions, rather than unrestricted agent safety.

An offboarding illustration and a reviewable record

In an illustrative employee-offboarding workflow, an agent receives six tools and no account-deletion tool. Policies require blocking Sam's sign-in before converting and sharing his mailbox, and checking legal-hold requirements before changing his email license. The gateway rejects premature calls. The agent then blocks sign-in, transfers mailbox access to Priya, checks and establishes the required hold, confirms protection and changes to a license supporting it. Every step is recorded without requiring human approval for each action. This is an illustration, not an established customer deployment or measured outcome.

Healthy system metrics do not establish that an agent completed its task, AWS argues. The article recommends reconstructing received context, tool calls, policy decisions and outcomes. AWS says Amazon CloudWatch Omni captures traces and places model and tool calls on an investigative timeline, with evaluators assessing correctness, faithfulness and tool selection. Failed traces can become test data for fixes; production observation supplements predeployment testing.

AWS recommends starting with one agent, one workflow and one provable boundary. Teams should explicitly decide which actions can proceed independently, which need approval and when the agent must stop, then widen or narrow responsibilities as evidence accumulates.