AWS Releases Loom, an Open-Source Reference Platform for Governing…

**AWS** released **Loom**, an open-source reference platform on **AWS Labs** for governing AI agents at enterprise scale. The project sits on **Strands Agents** and **Bedrock AgentCore Runtime** and is framed as a reference implementation for how agent fleets can be controlled, identified, and deployed under enterprise constraints.

Technically, Loom implements **RFC 8693 token exchange** so identity can propagate through delegated actor chains rather than collapsing into a single service principal. Deployments are **config-driven** and avoid runtime code generation, which keeps policy and topology declarative. **Mandatory tagging** is part of the model, so ownership, environment, and policy scope can be enforced as first-class metadata on agent workloads.

For engineers and builders running multi-agent systems, the hard problem is not calling a model once—it is tracing who acted, on whose behalf, and under which grant when one agent calls another. Token exchange through delegated chains gives a concrete pattern for least-privilege identity hop-by-hop. Config-only deploys reduce the gap between security review and what actually ships, because operators can reason about topology without auditing generated glue code at runtime.

In market terms, AWS is not shipping Loom as a finished product surface so much as an example of how **AgentCore**-style runtimes and agent SDKs can be assembled for governance. That places it in the same conversation as enterprise agent control planes and identity-aware orchestration, while keeping the artifact inspectable and forkable on AWS Labs instead of locked behind a managed console alone.

Practical takeaway: treat Loom as a blueprint for identity propagation, tagging, and config-driven agent deployment on AWS, not as a drop-in managed control plane. Watch how teams adapt the **RFC 8693** chain and mandatory tagging into their own runtimes, and whether similar reference stacks appear for non-Bedrock agent hosts so the same governance shape can travel off a single cloud path.