Seven concepts, three vocabularies
Lesson 3 of 5 in The Cloud Agent Landscape: Three Managed Platforms, One Map.
Here is the finding that makes this landscape learnable: the three platforms have converged on the same seven concepts. Managed runtime, session state and memory, a tool gateway, agent identity, guardrails and policy, observability, evaluations. Nobody coordinated this; they all hit the same wall — you cannot productionise a model-directed loop without those seven — and they all shipped the same answers under different nouns.
Learn the concepts and you can read any of the three doc sets in an afternoon. Learn one vendor’s nouns and you have learned a vocabulary, not an architecture.
| Concept | AWS — Bedrock AgentCore | Microsoft — Foundry Agent Service | Google — Agent Platform (formerly Vertex AI) |
|---|---|---|---|
Managed runtime — where a session executes | Runtime: serverless micro-VM per | Prompt agents need no compute you manage; hosted agents run per-session VM-isolated sandboxes with a persistent filesystem, scale to zero and resume statefully; idle timeout configurable 2–60 min, default 15. (Learn — What are hosted agents?) | Agent Runtime (formerly Agent Engine): fully managed deploy and scale with revisions and traffic management; hosts ADK, LangChain, LangGraph, AG2, LlamaIndex, A2A, custom. Session and idle semantics were not printed on the overview page — read the live docs. (Agent Platform overview, checked 2026-09) |
Session state and memory — short-term vs long-term | Memory: short-term raw events (messages, tool calls) plus long-term records extracted by configurable strategies — semantic, summarisation, user preference, episodic, custom. Scoped by | Conversations are durable server-side item history; a separate keyed-JSON state store persists independently of compute (good for framework checkpoints) with a 30-day idle window; the session filesystem keeps | Sessions hold short-term interactions; Memory Bank generates long-term memories with generative models rather than storing turns verbatim, with memory profiles and revisions. (Memory Bank overview) |
Tool gateway — many APIs, one governed surface | Gateway converts Lambda, API Gateway stages, OpenAPI, Smithy, and remote MCP servers into MCP tools; aggregation mode presents one MCP server across all targets; built-in semantic tool search over indexed tool definitions; ingress and egress auth in one place. (Developer Guide — MCP targets) | Toolbox: curated tools behind a single managed MCP-compatible endpoint, versioned and promotable without redeploying agents, consumable by non-Foundry MCP clients. Tool search (preview) exposes only | Tools are largely an ADK concern — function, MCP, OpenAPI, and built-ins such as Google Search, with tool auth. At platform level, Agent Gateway routes and authorises calls made during agent execution, and a Skill Registry stores and dynamically loads skills. (adk.dev; Agent Platform pricing/overview) |
Agent identity — who the agent is, and whose authority it borrows | AgentCore Identity: agents are workload identities, each with a distinct ARN in a central directory. Inbound: IAM SigV4 or OAuth JWT validated against your IdP. Outbound: a KMS-encrypted token vault of per-user OAuth tokens, refresh tokens, and API keys. (Developer Guide — Identity; AWS Security Blog) | Entra Agent ID: a special kind of service principal with an optional human sponsor, created from a reusable blueprint that acquires tokens for it. Hosted agents get a dedicated Entra identity automatically; with a user token the agent uses On-Behalf-Of delegation. Verify launch stage. (Learn — Agent identities) | IAM-based: agents run under service accounts you control, with VPC Service Controls, CMEK, data residency, and Access Transparency documented per service, not uniformly — re-read the enterprise-security matrix rather than assuming coverage. (Agent Platform overview — security table) |
Guardrails and policy — the rule the model cannot argue with | Bedrock Guardrails (content filters, denied topics, word and sensitive-information filters, contextual grounding, automated reasoning) plus AgentCore Policy: attribute-based Cedar permit/forbid rules evaluated at Gateway on every action, able to condition on tool-call arguments. Since July 2026 guardrail checks also run at the Gateway layer. (Console help — Policy in AgentCore; release notes) | A guardrail is a named collection of controls, each with a risk, intervention points, and a response action. Four intervention points: user input, tool call (preview), tool response (preview), output. Prompt Shields cover jailbreaks and document attacks (XPIA); Spotlighting (preview) tags untrusted content; network egress controls (preview) for hosted agents. (Learn — Guardrails overview; Prompt Shields) | Gemini safety filters across four harm categories with per-category thresholds, plus non-configurable CSAM and PII filters. Semantic Governance Policies are natural-language constraints that govern agents through their tool calls, applying to all agents on Agent Runtime. (Configure safety filters; Agent Platform pricing) |
Observability — how you debug one bad run | Observability emits OpenTelemetry to CloudWatch (GenAI Observability page) over a session → trace → span hierarchy with GenAI semantic conventions and W3C trace context. Requires a one-time per-account CloudWatch Transaction Search enablement. Agents hosted elsewhere can ship telemetry via the ADOT SDK. (Developer Guide — Observability; Well-Architected Agentic AI Lens) | Traces land in Azure Application Insights using OTel GenAI semantic conventions, viewable in the portal Traces view or Azure Monitor; capturing message content is opt-in because it may carry personal data. External agents can be registered for observability and evaluation (preview). (Learn — Set up tracing; Register external agents) | Cloud Trace and Cloud Logging, with console views for sessions, traces, logs, and events plus an agent playground — introduced as preview in late 2025, so confirm the current stage. (Vertex AI release notes; Agent Platform overview) |
Evaluations — is this release better than the last one? | Evaluations (GA March 2026): on-demand scoring of a session, optionally against ground truth — expected responses, expected tool trajectories, behavioural assertions — for CI regression, and online evaluation sampling live traffic at a configured rate. Built-in evaluators plus LLM-judge and code-based (Lambda) custom evaluators. (AWS ML Blog — Evaluate any agent framework) | Built-in evaluators for quality, RAG metrics such as groundedness, safety, and agent-specific metrics including tool-call accuracy and task completion; evaluation runs over the same App Insights telemetry as tracing. An agent optimizer (limited preview) proposes improved instructions, tools, and model choices. (Learn — Observability in generative AI) | A managed evaluation service sits alongside Runtime, with an Example Store and a Feedback service for user feedback next to telemetry; Gen AI evaluation is exposed through the SDK. Launch stages vary — check per feature. (Agent Platform overview; release notes) |
Read down the columns and three convergences jump out. Short-term state is always its own service, separate from any durable derived store — and where a platform sells the derived tier (AgentCore Memory strategies, Google’s Memory Bank) the two have opposite latency requirements; Foundry leaves the derivation to you. Tools arrive through a governed choke point, usually an MCP-compatible one, because the alternative is credentials scattered across agent code and a context window full of schemas. And policy always sits outside the agent process, at the gateway or at named intervention points, because a rule the model can read is a rule the model can be talked out of.
The divergences matter just as much. The policy artifact differs in kind: formal Cedar rules you can reason about statically, named controls at fixed intervention points, or natural-language constraints evaluated by a model. The identity plane differs by heritage — IAM workload identities, Entra service principals with human sponsors, Google Cloud service accounts. And evaluation maturity is where the gap is widest and moving fastest; treat any claim about it, including this module’s, as a snapshot.
Where a managed platform gets between the model and the world
- Model requests a tool call
The agent emits a structured request. Nothing has happened in the world yet — this is still just text.
- Gateway receives the call
AgentCore Gateway, a Foundry Toolbox endpoint, or Agent Gateway. One choke point for every tool, which is what makes the next two steps possible at all.
- Ingress auth: may this caller use this gateway?
SigV4 or OAuth JWT on AgentCore; Entra identity or OBO token on Foundry; IAM on Google Cloud. The agent identity, not the human’s, is what is being checked here.
- Policy decision on this action
Cedar permit/forbid conditioned on tool arguments; a control at the tool-call intervention point; a natural-language governance policy. Deterministic where it can be, model-evaluated where it must be.
- Denied — refusal returned to the agent
The refusal becomes an observation in the loop. A well-designed agent reports or escalates rather than retrying the same forbidden action.
- Egress auth: platform attaches backend credentials
Token vault or credential injection. The agent never sees the secret, which is why a leaked prompt does not leak the credential.
- Backend API or MCP server executes
Your Lambda, your SaaS API, your database — the part that has actual side effects.
- Output scanned before it re-enters context
Tool-response intervention points and injection detection live here. Tool output is untrusted input: this is the step that catches instructions hidden in retrieved content.
- Result appended to context; loop continues
And a span is emitted for every hop above, which is what makes the run debuggable afterwards.
- Agent decides the next step
Interactive sorting exercise: Ten vendor nouns. Drop each into the concept it implements — this is the translation table you will use every time you read a doc page.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.