Private cloud
Agent workflow on a managed cloud runtime
A managed agent runtime that handles orchestration, memory, tool invocation and observability; a model from the same cloud; your APIs exposed as tools; private networking; and human approval gates on consequential actions. Same shape as the framework-hosted agent, one tenancy instead of two.
- Source
- Editorial recipe — no step evidence has been fetched yet
- Verified
- Evidence not verified
- Confidence
- Low
01Objective
Build a multi-step agent on your cloud provider’s managed agent platform — AWS AgentCore, Microsoft Foundry Agent Service or Vertex AI Agent Engine — keeping the orchestration, the model and the traces inside your own account.
- use caseAgent workflowA multi-step process where a model chooses which tool to call next — read a ticket, look something up, update a record, hand off to a person. The interesting question is not the model but where the loop is allowed to stop and who can undo what it did.
- use caseAI customer-support agentAn assistant that answers customer questions from your help content and account systems, resolves what it can, and hands the rest to a person with context attached. Deflection rate matters less than what happens on the cases it cannot close.
- use caseCompany researchAssembling a picture of an organisation — ownership, filings, news, sanctions exposure, key people — from public sources, with each statement traceable to the page it came from. Used for onboarding, due diligence and competitor tracking.
- use caseEmployee helpdeskAn internal assistant that answers staff questions about IT, facilities, expenses and policy, and can perform routine service actions such as resets and access requests. Same shape as customer support, different audience and different data.
- use caseReport generationProducing a recurring document — a management pack, client update, board summary, compliance return — from data and prior text. The template and the data are fixed; the narrative around them is what takes the time.
02Recommended stack
| Role | Component |
|---|---|
| Authentication | Cloud identity for the agent and its tools |
| Inferenceoptional | Azure OpenAI (for the Foundry path) |
| Inference | Managed model (Claude, Gemini or GPT in your cloud) |
| Ingestion | Tools via the managed gateway (MCP / your APIs) |
| Orchestration | Amazon Bedrock AgentCore |
| Orchestrationoptional | Microsoft Foundry Agent Service |
| Orchestrationoptional | Vertex AI Agent Engine |
Architecture and data flow
Components
- Users / triggering system — people
- Private endpoints — network
- Managed agent runtime — application
- Tools + knowledge (managed gateway / MCP) — retrieval
- Agent memory + traces — database
- Managed model service — inference server
- Company systems the agent acts on (CRM, ticketing, mailbox) — internal system
- Frontier model (Claude / Gemini / GPT) — model
Connections
- Users / triggering system to Private endpoints — HTTPS (confidential data)
- Private endpoints to Managed agent runtime — reverse proxy (confidential data)
- Managed agent runtime to Tools + knowledge (managed gateway / MCP) — question + user groups (confidential data)
- Tools + knowledge (managed gateway / MCP) to Agent memory + traces — documents + permissions (confidential data)
- Managed agent runtime to Agent memory + traces — chats, users, settings (personal data)
- Tools + knowledge (managed gateway / MCP) to Managed model service — prompt + retrieved passages (confidential data)
- Managed model service to Frontier model (Claude / Gemini / GPT) — loaded weights
- Tools + knowledge (managed gateway / MCP) to Company systems the agent acts on (CRM, ticketing, mailbox) — tool actions (read and write) (confidential data)
External data transfer · SOME
- confidential content leaves your premises for your own cloud tenancy ("Private endpoints"). You keep control of the account; the provider is a processor, so a DPA and a documented region apply.
- confidential content leaves your premises for your own cloud tenancy ("Tools + knowledge (managed gateway / MCP)"). You keep control of the account; the provider is a processor, so a DPA and a documented region apply.
- The orchestration, model, tools and traces all sit in one cloud account and region you control; the provider is a processor for each. The managed runtime may store content — a term to verify, not assume.
- The actions land in systems you control; those writes are not a transfer out, but the consequential ones should pass a human gate.
03Suitable for
- Organisation size
- 50–20000 employees
- Data classes
- confidential, personal
- Constraints
- a cloud account with a landing zone, identity and a signed agreement already in place; a genuine multi-step task, and systems with APIs the agent can call; a team, or an implementation partner, to build and govern the agent
- Industries
- Technology, Financial services, Professional services, Retail, Telecommunications
- Jurisdictions
- any
04Hardware
No hardware profile was sized for this answer.
Indicative costUSD · one-off plus monthly
- Software
- No third-party licence: the agent is yours and the managed runtime bills on usage. The model bill sits on the model line.
- US$0
- Model usage
- Not estimated here: priced per token — see the cost section, which multiplies a fetched price by the usage band read from your brief. An agent loops, so it uses more tokens per task than a single answer.
- Not estimated
- Managed runtime, memory, gateway and network
- Not estimated: the agent runtime, memory store, gateway and observability are billed per the platform’s own consumption model, per region. No price list was fetched — read yours.
- Not estimated
- Implementation (8–20 FDE-days)
- 8–20 FDE-days at US$760–1940 per day, converted from the HK$6,000–15,000 band at the HKMA Linked Exchange Rate band of HK$7.75–7.85 to one US dollar. One-off; excludes internal staff time.
- US$6,080 – US$38,800
- The model line is the metered one and larger per task than a single answer because the agent loops; the cost section computes it from a fetched price and the usage band.
- The managed runtime adds its own consumption charges beyond the model — memory, gateway and observability — which vary by platform.
- A cloud account, identity and a signed agreement already exist; this adds a service, not a cloud programme.
05Difficulty
4 / 5
Multiple weeks and a team that has shipped infrastructure
06Skills
- API integrationapi-integration
- development
- LLM evaluationllm-evaluation
- ml
- Networkingnetworking
- networking
- Prompt engineeringprompt-engineering
- ml
- Security hardeningsecurity-hardening
- security
- Workflow automationworkflow-automation
- operations
07Deployment steps
Commands are copied from each project’s own documentation, and the page they came from is linked under the step. 0 of 7 steps currently open an evidence record. The rest are linked to their source; §10 says which of those documents were fetched and which were fetched without their anchor being found — two different states, named differently there.
- 01
Choose the currently supported managed agent platform for your cloudversion-sensitive
AssessmentEach hyperscaler has one. On AWS it is AgentCore — "an agentic platform for building, deploying, and operating highly effective agents securely at scale using any framework and foundation model" — and note the churn: AWS states "Amazon Bedrock Agents (now Amazon Bedrock Agents Classic) is no longer open to new customers", so build on AgentCore, not the older service. Azure has Foundry Agent Service and Google has the Agent Platform runtime.
- 02
Pick the model from the same cloud
AssessmentThe runtime and the model live together. Microsoft frames the unit plainly: an agent is "a model paired with instructions and tools that can reason over a request and take action". Choose a model your platform offers in your region — a first-party one keeps the contract simplest — and remember the catalogue is bounded by the cloud you are on.
- 03
Expose your APIs as governed tools
AssessmentThe managed gateway is how your systems become tools. AgentCore’s Gateway is "a secure way to convert your APIs, Lambda functions, and existing services into Model Context Protocol (MCP)-compatible tools"; the other platforms wrap your APIs similarly. Define each tool narrowly, validate its inputs, and treat every tool as a permission you are granting the model.
- 04
Scope the agent’s identity, permissions and approval gates
AssessmentThe platform’s point is that agents "take actions across tools and data with the right permissions and governance" — so use the governance. Run tools under the triggering user’s permissions rather than a superuser, put an explicit approval gate before any action that changes something or affects a person, and write down which actions may ever run unattended.
- 05
Turn on the built-in observability
AssessmentThese runtimes trace agents for you. Google’s is "a fully managed Agent Runtime to deploy and scale agents efficiently without the need to manage underlying infrastructure", with built-in observability; Foundry "hosts and runs the agent for you, with no application code or containers to maintain" and traces it. Wire the traces to your own monitoring — they are the audit record of what the agent did.
- 06
Read what the managed runtime does with your contentversion-sensitive
AssessmentA managed runtime can store the content it processes. AWS states that "AgentCore may use and store your content to improve your service experience or performance" — for your own use, not other customers’, but still a storage-and-use term to understand. Find the equivalent for your platform, confirm the retention and any opt-out, and settle it in the contract before real data flows.
- 07
Evaluate on real tasks, and confirm the region
AssessmentBuild real tasks with agreed outcomes and run them before launch and after every change — an agent’s failures compound. Confirm the managed runtime and the model are both available in the region your residency rule needs: a managed Agent Runtime is a newer service than the base model, so its regional coverage is thinner and worth checking first.
08Compliance considerations
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
Applies everywhere
Retention · Model training · Confidentialityhigh
A managed agent runtime may itself store your content. AWS states that "AgentCore may use and store your content to improve your service experience or performance" (for your use, not other customers’). Read the equivalent for your platform, confirm the retention and whether an opt-out exists, and treat it as a processor term to settle in the contract.
Human oversight · Automated decision-makinghigh
The platform lets agents "take actions across tools and data with the right permissions and governance" — use the governance. Put an approval gate on any action that changes something or affects a person, scope each tool to least privilege, and keep the trace of what was approved by whom.
Data residency · Cross-border transfershigh
Pin the runtime, the model, the memory store and the traces to one region, and confirm the managed runtime and the model are both offered there. A managed agent runtime is a newer service than the base model API, so its regional availability is worth checking first.
Terms-of-service restrictions · Model accessmedium
These platforms are moving fast: AWS states that "Amazon Bedrock Agents (now Amazon Bedrock Agents Classic) is no longer open to new customers". Build on the currently supported service, and factor the platform’s roadmap and deprecation history into the decision.
09Alternatives
A framework you host, calling a model API
When you need control over the orchestration graph that a managed runtime does not give, host LangGraph yourself and call a model API. More control, more to operate, and the model call leaves your account.
- — Full control over the graph, the tools and the traces
- — You host and operate the orchestration, and the model call goes to a vendor
A single retrieval-grounded answer inside your cloud
If the task is really one retrieval and one answer, the managed-model assistant in your cloud is simpler and cheaper than an agent runtime, and far easier to make reliable.
- — Much simpler and more predictable
- — Cannot plan, use tools or loop
- Private cloudAssistant on Amazon BedrockA model served through Amazon Bedrock, Bedrock Knowledge Bases for retrieval over your content (with OpenSearch Serverless if you manage the vector store yourself), a web application you build, IAM Identity Center for sign-in, and a VPC with PrivateLink so the call stays on your network.
- Model APIAgent workflow on a model vendor’s APILangGraph as the orchestration graph mixing deterministic and model-driven steps, a closed model (GPT-5, Claude or Gemini) for the reasoning, your own tools for the actions, Langfuse for tracing and evaluation, and human approval gates on the steps that change something.
10Evidence
Not yet in the ledger
not yet fetched
not yet fetched
not yet fetched
not yet fetched
not yet fetched
not yet fetched
not yet fetched
not yet fetched
11Community
Deployed this stack, or hit something this page does not cover? Corrections, sources and implementation reports are what keep a recipe worth reading.
Improve this page
Sign in to contribute
From the field
0 deployments · 0 questions
Nobody has reported deploying this here yet, and no question has been opened against this page. Both appear once a reviewer accepts them.
12Hire an FDE
If you would rather not build it, we can introduce a forward-deployed engineer who has deployed this stack before. The enquiry form starts from this recipe.