Amazon Bedrock Agents — AGS v2.2 Compliance

Executive Summary

Amazon Bedrock Agents achieves a 22% estimated AGS v2.2 compliance score. The platform leverages AWS's robust infrastructure to provide strong operational boundary enforcement, namespace isolation, and record integrity verification. IAM-based access controls and CloudTrail integration deliver solid foundational governance capabilities. However, no multi-party authorisation workflows are evidenced in public documentation, cross-jurisdiction compliance mapping, and model provenance tracking. Advanced governance groups covering emergence monitoring, collective intelligence governance, and physical impact assessment remain structurally absent.

A: Mandate

36%

B: Integrity

32%

C: Identity

28%

D: Accountability

28%

E: Compliance

24%

F: Adversarial

4%

G: Boundary

4%

H: Alignment

8%

I: Emergence

0%

J: Infrastructure

8%

Key Strengths

AG-01

Operational Boundary Enforcement

Bedrock Agents enforce operational boundaries through action groups, API schemas, and IAM resource policies that restrict agent capabilities to defined scopes.

Score: 2 / 3

AG-15

Namespace Isolation

AWS account boundaries, VPC configurations, and resource-level IAM policies provide strong namespace isolation between agent deployments.

Score: 2 / 3

AG-06

Record Integrity Verification

CloudTrail integration provides tamper-evident logging of all agent API calls with cryptographic log file validation.

Score: 2 / 3

Critical Gaps

AG-42

Collective Intelligence Governance

No multi-agent swarm governance. No mechanisms to govern emergent behaviour from groups of coordinating agents are evidenced in public documentation.

Score: 0 / 3 — Structurally Absent

AG-44

Long-Horizon Attack Detection

No temporal attack detection capabilities. Identification of adversarial strategies executed incrementally over extended time periods is not evidenced in public documentation.

Score: 0 / 3 — Structurally Absent

AG-50

Physical Impact Governance

No physical world governance framework. Assessment or control of potential physical-world consequences of agent actions is not evidenced in public documentation.

Score: 0 / 3 — Structurally Absent

Recommendations

Add multi-party authorisation (AG-17) for Bedrock agent workflows, enabling approval chains for high-impact agent actions.
Implement cross-jurisdiction compliance mapping (AG-47) for multi-region deployments, ensuring agents respect jurisdictional data and operational boundaries.
Build model provenance tracking (AG-48) for foundation model integrity, creating an auditable chain from model selection through deployment.
Develop purpose-bound operation enforcement (AG-20) to ensure agents operate strictly within their declared purpose scope.
Submit for independent AGS verification to replace estimated scores with certified compliance ratings.

Full Dimension Assessment

Dimension	Name	Category	Score
A — Mandate & Action Governance (AG-01 – AG-05)
AG-01	Operational Boundary Enforcement	Evidenced	2
AG-02	Cross-Domain Activity Governance	Not Documented	0
AG-03	Adversarial Coordination Detection	Not Documented	0
AG-04	Mandate Scope Control	Evidenced	1
AG-05	Action Authorisation Verification	Evidenced	1
B — Integrity & Configuration Governance (AG-06 – AG-10)
AG-06	Record Integrity Verification	Evidenced	2
AG-07	Governance Configuration Control	Evidenced	1
AG-08	Deployment Integrity Verification	Evidenced	1
AG-09	Delegated Authority Governance	Not Documented	0
AG-10	Configuration Drift Detection	Not Documented	0
C — Identity & Access Governance (AG-11 – AG-15)
AG-11	Agent Identity Verification	Not Documented	0
AG-12	Credential Lifecycle Management	Evidenced	1
AG-13	Privilege Escalation Prevention	Evidenced	1
AG-14	Inter-Agent Authentication	Not Documented	0
AG-15	Namespace Isolation	Evidenced	2
D — Accountability & Oversight (AG-16 – AG-20)
AG-16	Decision Audit Trail	Evidenced	1
AG-17	Multi-Party Authorisation	Not Documented	0
AG-18	Outcome Attribution	Evidenced	1
AG-19	Human Oversight Architecture	Evidenced	1
AG-20	Purpose-Bound Operation	Not Documented	0
E — Compliance & Agent Governance (AG-21 – AG-25)
AG-21	Regulatory Compliance Verification	Evidenced	1
AG-22	Behavioural Consistency Verification	Evidenced	1
AG-23	Resource Consumption Governance	Evidenced	1
AG-24	Output Validation	Not Documented	0
AG-25	Financial Transaction Governance	Structurally Absent	0
F — Adversarial Defence (AG-26 – AG-30)
AG-26	Prompt Injection Defence	Not Documented	0
AG-27	Governance Override Resistance	Not Documented	0
AG-28	Collusion Detection	Structurally Absent	0
AG-29	Data Poisoning Defence	Not Documented	0
AG-30	Social Engineering Resistance	Not Documented	0
G — Boundary & Scope Governance (AG-31 – AG-35)
AG-31	Capability Boundary Enforcement	Not Documented	0
AG-32	Scope Creep Detection	Not Documented	0
AG-33	Environmental Boundary Control	Not Documented	0
AG-34	Cross-System Propagation Control	Structurally Absent	0
AG-35	Autonomy Level Governance	Structurally Absent	0
H — Alignment & Reasoning Governance (AG-36 – AG-40)
AG-36	Value Alignment Verification	Not Documented	0
AG-37	Reasoning Transparency	Not Documented	0
AG-38	Human Control Responsiveness	Evidenced	1
AG-39	Deception Detection	Not Documented	0
AG-40	Goal Stability Verification	Structurally Absent	0
I — Emergence & Evolution Governance (AG-41 – AG-45)
AG-41	Emergent Capability Detection	Structurally Absent	0
AG-42	Collective Intelligence Governance	Structurally Absent	0
AG-43	Self-Modification Prevention	Structurally Absent	0
AG-44	Long-Horizon Attack Detection	Structurally Absent	0
AG-45	Evolutionary Pressure Monitoring	Structurally Absent	0
J — Infrastructure & Operational Governance (AG-46 – AG-50)
AG-46	Infrastructure Dependency Mapping	Structurally Absent	0
AG-47	Cross-Jurisdiction Compliance	Structurally Absent	0
AG-48	Model Provenance Tracking	Structurally Absent	0
AG-49	Operational Continuity	Evidenced	1
AG-50	Physical Impact Governance	Structurally Absent	0

Sources

Sources: Amazon Bedrock AgentCore documentation, AWS re:Invent 2025 sessions, Bedrock Guardrails documentation, AgentCore Gateway GA announcement March 2026, Cedar policy language specification. Documentation reviewed April 2026.
Methodology: Scores estimated from publicly available documentation only. No proprietary or non-public information was used. Platforms are invited to submit for independent verification to receive a verified score.