AWS expanded Bedrock AgentCore with web search, managed knowledge, observability, and controls for safer production agent deployments. Read the guide.
What AgentCore is expanding into
AWS Bedrock AgentCore is adding the pieces that production agent systems usually assemble by hand: web search, managed enterprise knowledge, observability, and operational controls. Together they move agents from isolated model calls toward systems that can look things up, ground answers in private material, and run under clearer guardrails.
That combination matters because agent quality fails in predictable places. Without current external context, answers drift. Without a managed knowledge path, teams bolt on retrieval that is hard to secure and harder to operate. Without visibility and controls, incidents are hard to diagnose and harder to contain. The expansion targets those gaps as one platform surface rather than a pile of custom glue.
Web search and managed knowledge in practice
Web search gives agents a way to pull current public information into a task instead of relying only on training data or stale context windows. That helps with product docs that change often, vendor status pages, release notes, and public APIs. The practical design rule is narrow retrieval: ask for the facts the agent needs for the next step, not an open-ended crawl that burns latency and confuses the plan.
Managed enterprise knowledge covers the other side of grounding: internal policies, runbooks, design docs, support history, and product catalogs. The value is not only search quality. It is consistent ingestion, access boundaries, and a stable interface so every agent does not invent its own retrieval stack. Treat knowledge as a product: define ownership, refresh cadence, sensitivity labels, and which agent roles may query which collections. Prefer citations or source pointers in the agent response path so operators can verify what the model used.
Observability and controls for safer production use
Observability turns agent runs from black boxes into inspectable workflows. You need traces across tool calls, knowledge lookups, model invocations, and final actions. Log inputs and outputs carefully, with redaction for secrets and personal data. Capture decision points—why a tool was chosen, which document was retrieved, whether a step was blocked—so failures can be replayed without guessing.
Controls sit on top of that visibility. Production agents should enforce least privilege on tools, allowlists for outbound web access, rate limits, budget caps per run, and human approval for high-impact actions such as writes, purchases, or customer-facing messages. Separate planning from execution when possible: let the agent propose a plan, then require policy checks before side effects. Safer deployment is less about a single safety switch and more about default-deny tooling, clear ownership of agent identities, and predictable failure modes when checks fail.
How teams should adopt the expansion
Start with one high-value workflow that needs both external context and internal truth—for example, support triage, ops diagnosis, or research that ends in a draft ticket. Wire web search and managed knowledge first, then add tracing so every run is reviewable. Only after the happy path is stable should you widen tool permissions or add autonomous write paths.
- Define success as correct, sourced answers and safe non-actions when confidence is low—not just task completion rate.
- Separate public web retrieval from private knowledge stores so access policies stay simple.
- Require observability on every new tool before it ships to production agents.
- Gate destructive or customer-visible actions behind explicit controls and audit logs.
AgentCore’s web search, managed knowledge, observability, and controls will not remove the need for good product judgment. They do reduce the amount of custom infrastructure required to run agents that can look things up, stay grounded in enterprise material, and fail in ways operators can see and stop. Build small, instrument early, and expand permissions only when the traces prove the system behaves under real traffic.