What Makes Agents Different?

Three Capabilities. Dangerous When Combined.

Meet the HR Assistant

An AI agent that helps employees with leave, payroll, onboarding

It has access to employee records, processes messages from users, and takes actions on other systems

Any concerns?

Sensitive Data Access

The agent can see what employees can't see about each other

• Employee records - names, salaries, performance reviews
• Payroll data - bank accounts, tax file numbers
• Leave balances and medical certificates
• Onboarding documents - ID copies, contracts

Untrusted Content

LLMs follow instructions in content, regardless of source

• Employee chat messages
• Uploaded resumes and CVs
• Forwarded emails
• RAG results from the knowledge base

External Actions

Data exfiltration as a feature

• Update payroll
• Send offer letters
• Book onboarding meetings
• Call external APIs

The Fundamentals Haven't Changed

• Least privilege - don't give agents permissions they don't need
• Defense in depth - multiple layers, not one guardrail
• Separation of concerns - isolate agent capabilities
• Audit everything - you can't secure what you can't see
• Encrypt by default - data at rest and in transit

The Map

Leg 1: Controlling Data Access

{
  "Effect": "Allow",
  "Action": [
    "bedrock-agentcore:GetMemory",
    "bedrock-agentcore:RetrieveMemoryRecords"
  ],
  "Resource":
    "arn:aws:bedrock-agentcore:
     ap-southeast-2:123456789012:
     memory/hr-assistant/*"
}

Leg 2: Defending Against Untrusted Content

Leg 3: Controlling Tool Access

AgentCore Policy - Cedar policies, enforced outside agent code

// HR assistant can read employee records
permit(
  principal is AgentCore::OAuthUser,
  action == AgentCore::Action::"HRTools__get_employee_record",
  resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:ap-southeast-2:123456789012:gateway/hr-assistant"
) when {
  principal.hasTag("role") &&
  (principal.getTag("role") == "hr-manager" || principal.getTag("role") == "hr-admin")
};

// Nobody can bulk-export salary data
forbid(
  principal is AgentCore::OAuthUser,
  action == AgentCore::Action::"HRTools__export_salary_report",
  resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:ap-southeast-2:123456789012:gateway/hr-assistant"
);

The agent doesn't decide its own permissions. You do.

Leg 3: Gateway + Identity

Audit Your Agents

• Apply least privilege to agent IAM roles
• Use AgentCore Policy (Cedar) for tool boundaries - not agent code
• Encrypt memory, validate inputs, test for injection
• Enable CloudTrail + CloudWatch for agent activity
• Ask: does your agent really need all three legs?