Seven concepts, three vocabularies

Lesson 3 of 5 in The Cloud Agent Landscape: Three Managed Platforms, One Map.

Here is the finding that makes this landscape learnable: the three platforms have converged on the same seven concepts. Managed runtime, session state and memory, a tool gateway, agent identity, guardrails and policy, observability, evaluations. Nobody coordinated this; they all hit the same wall — you cannot productionise a model-directed loop without those seven — and they all shipped the same answers under different nouns.

Learn the concepts and you can read any of the three doc sets in an afternoon. Learn one vendor’s nouns and you have learned a vocabulary, not an architecture.

The same seven capabilities under three vocabularies — names, limits, and launch stages checked September 2026; verify per-feature stage before you depend on any cell.
ConceptAWS — Bedrock AgentCoreMicrosoft — Foundry Agent ServiceGoogle — Agent Platform (formerly Vertex AI)

Managed runtime — where a session executes

Runtime: serverless micro-VM per runtimeSessionId, isolated CPU/memory/filesystem, destroyed and sanitised at termination; 15-min idle, 8-hour max. Instances substrate runs EC2-backed sessions up to 14 days with persistent volumes. (AgentCore Developer Guide — How AgentCore Runtime works)

Prompt agents need no compute you manage; hosted agents run per-session VM-isolated sandboxes with a persistent filesystem, scale to zero and resume statefully; idle timeout configurable 2–60 min, default 15. (Learn — What are hosted agents?)

Agent Runtime (formerly Agent Engine): fully managed deploy and scale with revisions and traffic management; hosts ADK, LangChain, LangGraph, AG2, LlamaIndex, A2A, custom. Session and idle semantics were not printed on the overview page — read the live docs. (Agent Platform overview, checked 2026-09)

Session state and memory — short-term vs long-term

Memory: short-term raw events (messages, tool calls) plus long-term records extracted by configurable strategies — semantic, summarisation, user preference, episodic, custom. Scoped by actorId + sessionId; retrieval by namespace path. Extraction is asynchronous. (Developer Guide — Memory)

Conversations are durable server-side item history; a separate keyed-JSON state store persists independently of compute (good for framework checkpoints) with a 30-day idle window; the session filesystem keeps $HOME and /files. (Learn — Runtime components; hosted agents)

Sessions hold short-term interactions; Memory Bank generates long-term memories with generative models rather than storing turns verbatim, with memory profiles and revisions. (Memory Bank overview)

Tool gateway — many APIs, one governed surface

Gateway converts Lambda, API Gateway stages, OpenAPI, Smithy, and remote MCP servers into MCP tools; aggregation mode presents one MCP server across all targets; built-in semantic tool search over indexed tool definitions; ingress and egress auth in one place. (Developer Guide — MCP targets)

Toolbox: curated tools behind a single managed MCP-compatible endpoint, versioned and promotable without redeploying agents, consumable by non-Foundry MCP clients. Tool search (preview) exposes only tool_search and call_tool. Tools Catalog connectors become managed MCP servers (preview). (Learn — What is Toolbox?)

Tools are largely an ADK concern — function, MCP, OpenAPI, and built-ins such as Google Search, with tool auth. At platform level, Agent Gateway routes and authorises calls made during agent execution, and a Skill Registry stores and dynamically loads skills. (adk.dev; Agent Platform pricing/overview)

Agent identity — who the agent is, and whose authority it borrows

AgentCore Identity: agents are workload identities, each with a distinct ARN in a central directory. Inbound: IAM SigV4 or OAuth JWT validated against your IdP. Outbound: a KMS-encrypted token vault of per-user OAuth tokens, refresh tokens, and API keys. (Developer Guide — Identity; AWS Security Blog)

Entra Agent ID: a special kind of service principal with an optional human sponsor, created from a reusable blueprint that acquires tokens for it. Hosted agents get a dedicated Entra identity automatically; with a user token the agent uses On-Behalf-Of delegation. Verify launch stage. (Learn — Agent identities)

IAM-based: agents run under service accounts you control, with VPC Service Controls, CMEK, data residency, and Access Transparency documented per service, not uniformly — re-read the enterprise-security matrix rather than assuming coverage. (Agent Platform overview — security table)

Guardrails and policy — the rule the model cannot argue with

Bedrock Guardrails (content filters, denied topics, word and sensitive-information filters, contextual grounding, automated reasoning) plus AgentCore Policy: attribute-based Cedar permit/forbid rules evaluated at Gateway on every action, able to condition on tool-call arguments. Since July 2026 guardrail checks also run at the Gateway layer. (Console help — Policy in AgentCore; release notes)

A guardrail is a named collection of controls, each with a risk, intervention points, and a response action. Four intervention points: user input, tool call (preview), tool response (preview), output. Prompt Shields cover jailbreaks and document attacks (XPIA); Spotlighting (preview) tags untrusted content; network egress controls (preview) for hosted agents. (Learn — Guardrails overview; Prompt Shields)

Gemini safety filters across four harm categories with per-category thresholds, plus non-configurable CSAM and PII filters. Semantic Governance Policies are natural-language constraints that govern agents through their tool calls, applying to all agents on Agent Runtime. (Configure safety filters; Agent Platform pricing)

Observability — how you debug one bad run

Observability emits OpenTelemetry to CloudWatch (GenAI Observability page) over a session → tracespan hierarchy with GenAI semantic conventions and W3C trace context. Requires a one-time per-account CloudWatch Transaction Search enablement. Agents hosted elsewhere can ship telemetry via the ADOT SDK. (Developer Guide — Observability; Well-Architected Agentic AI Lens)

Traces land in Azure Application Insights using OTel GenAI semantic conventions, viewable in the portal Traces view or Azure Monitor; capturing message content is opt-in because it may carry personal data. External agents can be registered for observability and evaluation (preview). (Learn — Set up tracing; Register external agents)

Cloud Trace and Cloud Logging, with console views for sessions, traces, logs, and events plus an agent playground — introduced as preview in late 2025, so confirm the current stage. (Vertex AI release notes; Agent Platform overview)

Evaluations — is this release better than the last one?

Evaluations (GA March 2026): on-demand scoring of a session, optionally against ground truth — expected responses, expected tool trajectories, behavioural assertions — for CI regression, and online evaluation sampling live traffic at a configured rate. Built-in evaluators plus LLM-judge and code-based (Lambda) custom evaluators. (AWS ML Blog — Evaluate any agent framework)

Built-in evaluators for quality, RAG metrics such as groundedness, safety, and agent-specific metrics including tool-call accuracy and task completion; evaluation runs over the same App Insights telemetry as tracing. An agent optimizer (limited preview) proposes improved instructions, tools, and model choices. (Learn — Observability in generative AI)

A managed evaluation service sits alongside Runtime, with an Example Store and a Feedback service for user feedback next to telemetry; Gen AI evaluation is exposed through the SDK. Launch stages vary — check per feature. (Agent Platform overview; release notes)

Read down the columns and three convergences jump out. Short-term state is always its own service, separate from any durable derived store — and where a platform sells the derived tier (AgentCore Memory strategies, Google’s Memory Bank) the two have opposite latency requirements; Foundry leaves the derivation to you. Tools arrive through a governed choke point, usually an MCP-compatible one, because the alternative is credentials scattered across agent code and a context window full of schemas. And policy always sits outside the agent process, at the gateway or at named intervention points, because a rule the model can read is a rule the model can be talked out of.

The divergences matter just as much. The policy artifact differs in kind: formal Cedar rules you can reason about statically, named controls at fixed intervention points, or natural-language constraints evaluated by a model. The identity plane differs by heritage — IAM workload identities, Entra service principals with human sponsors, Google Cloud service accounts. And evaluation maturity is where the gap is widest and moving fastest; treat any claim about it, including this module’s, as a snapshot.

Where a managed platform gets between the model and the world

  1. Model requests a tool call

    The agent emits a structured request. Nothing has happened in the world yet — this is still just text.

  2. Gateway receives the call

    AgentCore Gateway, a Foundry Toolbox endpoint, or Agent Gateway. One choke point for every tool, which is what makes the next two steps possible at all.

  3. Ingress auth: may this caller use this gateway?

    SigV4 or OAuth JWT on AgentCore; Entra identity or OBO token on Foundry; IAM on Google Cloud. The agent identity, not the human’s, is what is being checked here.

  4. Policy decision on this action

    Cedar permit/forbid conditioned on tool arguments; a control at the tool-call intervention point; a natural-language governance policy. Deterministic where it can be, model-evaluated where it must be.

  5. Denied — refusal returned to the agent

    The refusal becomes an observation in the loop. A well-designed agent reports or escalates rather than retrying the same forbidden action.

  6. Egress auth: platform attaches backend credentials

    Token vault or credential injection. The agent never sees the secret, which is why a leaked prompt does not leak the credential.

  7. Backend API or MCP server executes

    Your Lambda, your SaaS API, your database — the part that has actual side effects.

  8. Output scanned before it re-enters context

    Tool-response intervention points and injection detection live here. Tool output is untrusted input: this is the step that catches instructions hidden in retrieved content.

  9. Result appended to context; loop continues

    And a span is emitted for every hop above, which is what makes the run debuggable afterwards.

  10. Agent decides the next step

Interactive sorting exercise: Ten vendor nouns. Drop each into the concept it implements — this is the translation table you will use every time you read a doc page.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.