« Phase 20 README · Warmup · Deep Dive · Principal Deep Dive · Core Contributor · Staff Notes

Phase 20 — Hitchhiker's Guide

The compressed practitioner tour. Read the WARMUP for the mechanism; this is the stuff you say in the meeting.

30-second mental model

AgentCore is not an agent framework — it's the ops layer underneath one. You bring the agent (LangGraph, CrewAI, Strands, any model, MCP/A2A), and AWS runs it "securely at scale" as composable primitives you adopt à la carte. The star primitive is the Runtime: it hosts your agent behind one @app.entrypoint and gives each session its own microVM — true isolation, no cross-session leakage. Around it: Gateway (turns functions/Lambdas/OpenAPI/services into MCP tools), Policy (Cedar deterministic allow/deny on every tool call, before execution), Memory (short-term event log + long-term strategy extraction that persists across sessions and is shared across agents), Identity (OAuth against any IdP), Observability (OTEL per step), plus Code Interpreter, Browser, Harness. The senior move: "AgentCore doesn't make my agent smarter — it makes it deployable, isolated, authorized, and observable."

The services to tattoo on your arm

The distinctions that signal seniority

• AgentCore vs LangGraph → different layers, not competitors. AgentCore hosts LangGraph.
• AgentCore vs Bedrock Agents → AgentCore = composable primitives, you own the loop, any framework. Bedrock Agents (older) = one fully-managed agent, AWS owns the loop.
• microVM vs container → microVM is a hardware-virtualization boundary (own kernel); a container shares the host kernel. Isolation strength is the whole security argument.
• Cedar Policy vs LLM guardrail → Cedar is deterministic (same request → same decision; no prompt can argue with a forbid). An LLM guardrail is stochastic.
• short-term vs long-term memory → session event log (ephemeral) vs strategy-extracted, namespaced, cross-session records (durable, shared across agents).

Cedar in 3 lines

1. Default-deny — nothing is allowed unless a permit matches.
2. Forbid-overrides — any matching forbid wins, always.
3. Request = (principal, action, resource, context); when { ... } is the condition.

The SDK/CLI one-liners

from bedrock_agentcore.runtime import BedrockAgentCoreApp
app = BedrockAgentCoreApp()

@app.entrypoint
def invoke(payload, context):        # context.session_id is your isolation key
    return {"result": my_agent.run(payload["prompt"])}

agentcore configure   # containerize + IAM role
agentcore launch      # deploy to the managed Runtime
agentcore invoke '{"prompt":"hi"}'

War stories

• The "we'll just use Bedrock Agents" that hit a wall. Team built a low-code Bedrock Agent, then needed a custom LangGraph branching loop AWS's orchestration couldn't express. On AgentCore they'd have kept the graph and rented the ops. Know which one you're choosing and why.
• The shared-process agent that leaked. An early internal agent ran all users in one process to "save cold starts." One session's cached file showed up in another's context. Per-session microVMs exist precisely so this is structurally impossible.
• The refund the prompt talked into happening. A support agent had an LLM "are you sure?" guard; a crafted message walked it past. A Cedar forbid(resource=="refund") when {amount>=1000} on the Gateway would have denied it deterministically, before execution — no argument possible.
• The agent with amnesia. Great demo, but every session started cold — no preferences, no history. Turning on Memory strategies (user_preference, semantic) made it feel like it knew the user across sessions. That's the difference between a toy and an assistant.

Vocabulary

AgentCore (ops layer) · Runtime (host) · entrypoint (@app.entrypoint) · microVM (per-session isolation) · cold/warm session · Gateway (MCP tool factory) · target (function/Lambda/OpenAPI/MCP) · Policy / Cedar (deterministic authz) · permit/forbid · default-deny / forbid-overrides · Identity / IdP / credential provider · short-term vs long-term memory · strategy (summary/semantic/user_preference) · namespace · actor · Observability / OTEL · Code Interpreter / Browser / Harness · A2A · Bedrock Agents (the older managed agent).

Beginner mistakes

1. Framing it as "AgentCore vs LangGraph" — it hosts LangGraph; wrong layer.
2. Confusing AgentCore (primitives) with Bedrock Agents (one managed agent).
3. Calling microVM isolation a "container" — it's stronger; that's the point.
4. Thinking Policy is an LLM check — it's deterministic Cedar, evaluated before execution.
5. Assuming you must adopt the whole platform — the services are independently adoptable.
6. Treating long-term memory as "the chat log" — it's strategy-extracted, namespaced, cross-session.
7. Forgetting AgentCore is AWS-specific and young — know the concepts, be honest about the vendor.