All 41 questions, made readable
Lesson 3 of 5 in The Well-Architected Agentic AI Lens: 41 Questions Worth Borrowing.
All 41 focus-area questions, in AWS’s order, with a plain reading of what each one is actually asking and why it bites an agent specifically. This is the reference lesson — scan it, do not study it. Open the pillar you are reviewing and read six questions.
Ids and question wording are AWS’s, verbatim. Everything after that is this course’s explanation. Practice ids are shortened to their suffix — BP01 under AGENTSEC06 is AGENTSEC06-BP01 — and the letter is AWS’s risk rating: H High, M Medium, L Low. Exact best-practice titles are in Appendix A; this lesson gives you the ids so you can find them and the meaning so you can decide whether you need to.
Operational excellence — AGENTOPS, 7 questions, 26 practices, 18 High
AGENTOPS01 — How do you establish operational practices for agentic AI systems?
Can you say in one sentence each what this agent is for, what counts as success, and where its job ends? Agents fail at the seams: an ambiguous scope means the agent improvises into territory nobody signed off on, and a handoff with no named human means a stuck task stays stuck. The third practice is the sharp one — your test scenarios have to cover the dependencies and the business process, not just the agent.
3 practices · BP01 H · BP02 H · BP03 H
AGENTOPS02 — How do you manage prompt and configuration lifecycle?
The prompt is production code: versioned, reviewed, diffable, revertible. The specific failure is drift — a prompt edited live, a tool schema tweaked, a model version silently upgraded underneath you — after which the behaviour you evaluated is not the behaviour you are running. Note that AWS rates drift detection and rollback High, which is unusual for configuration hygiene and tells you how often this one bites.
4 practices · BP01 H · BP02 H · BP03 H · BP04 M
AGENTOPS03 — How do you manage agent lifecycle and deployment processes?
Who owns this agent, what has to pass before a change reaches users, and who can answer which of our agents can reach customer data once there are twenty of them. Agent pipelines differ from ordinary CI in one structural way: the tests are statistical, so the gate is a pass rate over repeated runs rather than a green tick. BP04 (portfolio governance at scale, High) is the fleet question, and it is the one nobody has an answer to at agent number twenty.
4 practices · BP01 H · BP02 H · BP03 M · BP04 H
AGENTOPS04 — How do you establish tool integration and management practices?
Tools are the agent’s hands, and each one is a dependency with a schema, an owner, a blast radius and a failure mode. You need a record of which tools exist and who approved them, one integration standard so every wiring job is not bespoke, and a defined behaviour when a tool times out or returns nonsense — otherwise the agent invents a plausible result and carries on. BP02 names MCP and A2A as the standardisation answer.
3 practices · BP01 M · BP02 H · BP03 M
AGENTOPS05 — How do you implement comprehensive observability and monitoring for agentic systems?
Can you reconstruct exactly what a run did — every prompt, every tool call, every result, in order — hours after it finished? For a stochastic system the trace is the only evidence the run happened the way you think it did. Dashboards come second: without per-run traces you cannot explain any number on them. Metrics here should describe distributions, not single runs.
5 practices · BP01 H · BP02 H · BP03 H · BP04 M · BP05 M
AGENTOPS06 — How do you implement testing, evaluation, and validation frameworks?
What evidence do you have that this agent works, beyond having watched it work? The answer is a graded set of real cases, run repeatedly because the same input can yield different outputs, checked deterministically wherever a deterministic check exists and by a calibrated judge only where one does not. BP03 (High) adds the part teams skip: someone with domain knowledge has to sign the resulting number.
3 practices · BP01 H · BP02 H · BP03 H
AGENTOPS07 — How do you establish operational recovery and consumption monitoring?
When the agent is the incident, what happens in the first five minutes? You want automated containment that does not need a meeting, a written runbook for stopping the thing by hand, and postmortems that feed back into your test set. Break-glass (BP04, High) means an operator can halt one tool, one tenant, or the whole agent without shipping a deploy — if stopping it requires a release, you do not have a kill switch.
4 practices · BP01 H · BP02 M · BP03 M · BP04 H
Security — AGENTSEC, 9 questions, 30 practices, 19 High
AGENTSEC01 — How do you secure agentic memory and securely manage state between agents?
Memory is a write path into future prompts. Anything the agent stores today is instruction-shaped input tomorrow, so an attacker who gets one sentence into memory has a persistent foothold. Partition memory per user and per tenant, validate writes rather than trusting them, and — BP03 — have a way to notice that a wrong fact has been retrieved and repeated with authority for a week.
3 practices · BP01 H · BP02 H · BP03 M
AGENTSEC02 — How do you control and secure agent tool usage?
Every tool the agent holds is a capability an attacker inherits the moment the model is persuaded. So authorisation must be decided outside the model — the runtime checks whether this agent, acting for this principal, may make this call with these arguments — and tool output must be treated as untrusted input, because a tool result is just more text entering the context. This is the same conclusion this course reaches from the injection side, arrived at from the identity side.
3 practices · BP01 H · BP02 H · BP03 M
AGENTSEC03 — How do you manage agent identities, permissions, and prevent privilege escalation?
Whose power is the agent wielding — its own, or the user’s? Both answers are legitimate, they have different failure modes, and you must pick deliberately and be able to prove which applied to a given action. The escalation trap is an agent with a service identity broader than any of its users, which quietly turns summarise my inbox into read anyone’s inbox. BP03 asks for least privilege with boundaries that move with the request, not a static role.
4 practices · BP01 H · BP02 H · BP03 H · BP04 M
AGENTSEC04 — How do you support agent goal alignment and prevent manipulation?
What stops this agent doing something catastrophic when its input is hostile? Two things, and the lens names only two: guardrails and constraints checked outside the model, and a human approval on actions that are irreversible or expensive. Instructions in the system prompt are a preference rather than a control, because the same channel carries the attacker’s text.
2 practices · BP01 H · BP02 H
AGENTSEC05 — How do you implement observability and prevent repudiation?
After the fact, can you prove what the agent did and why — and can nobody credibly deny it? That needs the decision artifacts kept, not just the outcome: the prompt, the retrieved context, the arguments, the result, tied to an agent identity and a human principal. Non-repudiation is the property auditors and incident responders actually ask for, and it is why AGENTOPS05’s traces have a security twin here.
2 practices · BP01 H · BP02 M
AGENTSEC06 — How do you secure multi-agent orchestration and coordination?
The moment a second agent exists, one agent’s output becomes another’s instructions, and a compromise propagates along that channel. Messages between agents need authentication and integrity; the boundary between a trusted and an untrusted peer needs to be an explicit design decision. BP04 adds a failure mode single agents do not have: agents looping on each other, or escalating each other’s scope, needs monitoring of the coordination pattern itself.
4 practices · BP01 H · BP02 H · BP03 H · BP04 M
AGENTSEC07 — How do you protect human oversight from manipulation and detect rogue agents?
A human approval is a control only while the human is still reading. Flood a reviewer with forty confident-sounding approvals an hour and they will rubber-stamp the forty-first, which makes oversight design partly a workload question — hence BP01, cognitive load management. The approval must also show the exact action and its real risk rather than the agent’s summary of it. BP04 (High) is separate and blunt: something has to notice an agent behaving unlike itself, and be able to contain it.
5 practices · BP01 M · BP02 M · BP03 M · BP04 H · BP05 M
AGENTSEC08 — How do you validate and secure agent inputs and outputs?
Prompt injection has no patch, because instructions and data arrive in the same channel. Layered filtering raises the cost of an attack; it is not a fix, and a classifier that catches 96% of payloads still fails against a determined attacker. The output side matters as much: what the agent emits can carry exfiltrated data or render as an attack in whatever UI displays it. This is the question where we part company with the lens — see the next lesson.
2 practices · BP01 H · BP02 H
AGENTSEC09 — How do you perform vulnerability scanning and penetration testing for agentic AI systems?
Testing an agent adversarially is not the same as scanning its container. The interesting attacks are semantic — a hostile document, a poisoned tool description, one agent persuading another — so they need adversarial testing against the agent’s behaviour, in an environment where a successful attack does not touch production (BP04), plus runtime detection for the attempts you did not anticipate (BP05, High).
5 practices · BP01 H · BP02 H · BP03 M · BP04 M · BP05 H
Reliability — AGENTREL, 8 questions, 33 practices, 18 High
AGENTREL01 — How do I develop reliable agentic systems?
The architecture question underneath everything else: what are the parts, and what happens when one is down or slow? Durable queues between stages so a crash does not lose work, fault isolation so a failing tool does not take the agent with it, and one communication standard rather than a bespoke integration per pair. Autonomy adds failure surface, so isolation is worth more here than in ordinary services.
5 practices · BP01 H · BP02 H · BP03 M · BP04 M · BP05 M
AGENTREL02 — How do you develop agentic systems that reliably execute tasks with predictable outcomes?
Predictability is bought by narrowing the job, not by writing a firmer prompt. A small atomic task with a short tool list and unambiguous instructions has far fewer ways to go wrong than a general assistant, and the permissions it holds cap the damage when it does. BP05 (High) is the tiered-oversight practice the lens cites as its human-oversight commitment: which threshold needs a human is a per-action decision, not a per-product one.
5 practices · BP01 M · BP02 H · BP03 H · BP04 M · BP05 H
AGENTREL03 — How do you support agent memory and state remaining reliably accessible throughout the agent lifecycle?
Long-running agents have state, and state is a dependency that can be unavailable. Decide first what genuinely needs to survive the session and what should be forgotten, then make the surviving part redundant and checkpointed so a run can resume rather than restart. BP04: an agent that loses its long-term store should say so and continue in a reduced mode, not silently behave as though the user is new.
4 practices · BP01 M · BP02 H · BP03 H · BP04 M
AGENTREL04 — How do you orchestrate multi-agent systems to reliably execute tasks?
A group of agents needs something to decide who does what and to adjudicate when two of them disagree — otherwise you get loops, duplicated side effects, and tasks that are everyone’s and no one’s. AWS calls that the arbiter agent pattern (BP01, High). The arbiter is itself a single point of failure, so BP04 asks for a resilient control plane, and BP03 for a defined answer when a specialist is unavailable.
4 practices · BP01 H · BP02 M · BP03 H · BP04 H
AGENTREL05 — How do you implement reliable agent cognition that accesses the right data at the right time?
Most “the agent is wrong” reports are retrieval failures wearing a reasoning costume: the model answered confidently from context that did not contain the answer. Grounding is the fix (BP03, High) — fetch the real record and cite it — and retrieval quality has to be measured separately from answer quality, or you will keep tuning the prompt to compensate for a bad index.
3 practices · BP01 M · BP02 M · BP03 H
AGENTREL06 — How do agents integrate effectively with existing systems without impacting the reliability of established processes?
The systems an agent will drive were built for callers that do the same thing twice. An agent retries, duplicates and calls at odd rates, so integrations need idempotency keys so a repeated request executes once (BP04, High), breakers and limits so the agent cannot take a legacy system down, and the ability to switch one capability off without redeploying the agent (BP05).
5 practices · BP01 M · BP02 H · BP03 M · BP04 H · BP05 M
AGENTREL07 — How do fault tolerant agent systems recover?
When a run dies at step nine of twelve, what happens? Restarting from step one repeats every side effect; abandoning the task leaves the work half done. Staged workflows with checkpoints let you resume from the last known-good state, and the trace is what tells you which state that was — recovery and observability are the same investment, which is why BP03 is a tracing practice inside the reliability pillar.
3 practices · BP01 H · BP02 H · BP03 H
AGENTREL08 — How do agents determine when and where graceful degradation is appropriate?
Degrading well is a decision made in advance: which capability drops first, what the agent says when it drops, and what it must never do instead. The alternative — an agent improvising around a missing dependency — is worse than a clear refusal. Getting there needs consistent configuration, telemetry to know which resource is under pressure, and isolation (BP03, High) so one busy tenant or one runaway run does not starve the rest.
4 practices · BP01 M · BP02 H · BP03 H · BP04 M
Performance efficiency — AGENTPERF, 7 questions, 24 practices, 16 High
AGENTPERF01 — How do you plan strategically for agent performance and establish measurement practices?
Pick the number that matters before you optimise anything: time to first token if a human is watching, time to done if a job runs unattended. Then instrument end to end and find out where the seconds actually go — in practice it is usually one long retrieval or one extra reasoning turn, not the thing the team assumed. All three practices here are High, which is the lens saying: do not optimise before you profile.
3 practices · BP01 H · BP02 H · BP03 H
AGENTPERF02 — How do you optimize core agent processing and cognitive pipelines?
The biggest lever is the loop itself: fewer turns, fewer tool calls, and the smallest model that passes your evals for each step rather than the strongest model everywhere. Streaming is the second lever — it does not reduce total work, but it changes when the user first sees something, which is often the metric they were actually complaining about.
4 practices · BP01 H · BP02 H · BP03 H · BP04 H
AGENTPERF03 — How do you optimize memory management, context windows, and retrieval-augmented generation?
Context is resent on every turn, so anything you carry you pay for repeatedly — in tokens, in latency, and in the model’s attention. Hence tiering (hot facts in context, the rest retrievable), compaction of long transcripts, retrieval tuned for precision rather than recall, and caching the stable prefix so it is not reprocessed each iteration.
5 practices · BP01 H · BP02 H · BP03 H · BP04 M · BP05 H
AGENTPERF04 — How do you achieve efficient communication and protocol usage across agent interactions?
Whenever an agent waits synchronously for something slow, you are paying latency for nothing. Long tool calls and inter-agent delegation want an asynchronous shape — submit, get a handle, poll or receive an event — and a run that can outlive the connection that started it. The protocol you choose determines how much of this you get for free.
3 practices · BP01 H · BP02 M · BP03 M
AGENTPERF05 — How do you optimize workflow orchestration and multi-agent collaboration for performance?
Multi-agent systems are usually slower than the single agent they replaced, because coordination is serialised: each handoff is a round trip and a re-briefing. The wins come from parallelising genuinely independent subtasks, keeping handoffs few and their briefs tight, and not delegating work that would have been one tool call.
4 practices · BP01 H · BP02 H · BP03 M · BP04 M
AGENTPERF06 — How do you optimize tool integrations and framework usage for agent performance?
Tool design is performance design. A hundred tool schemas in every request costs tokens and degrades selection accuracy; a tool that returns an entire record when the agent needed one field costs a turn to summarise. Batching, filtering at the source, and returning results the model can act on directly all remove iterations. BP03 (meta-tools and chaining) is the lens’s only Low-risk practice.
3 practices · BP01 M · BP02 M · BP03 L
AGENTPERF07 — How do you manage multitenant performance isolation and optimize resource utilization?
Agent workloads are spiky and one tenant can be pathological — a single run that loops fifty times consumes the capacity of a hundred normal ones. Without per-tenant quotas and throttling, your worst customer sets everyone’s latency. The isolation model you pick also decides what you can promise about data separation, so this is a security decision wearing a performance hat.
2 practices · BP01 H · BP02 H
Cost optimization — AGENTCOST, 7 questions, 24 practices, 14 High
AGENTCOST01 — How do you optimize agent reasoning and execution costs?
Every extra loop iteration is another full-context inference call. Self-critique passes and multi-agent handoffs are the two places teams accidentally double their spend: a reflection pass is worth it when it catches real errors and is pure overhead when it does not, and each handoff re-sends a brief. Measure both against quality before keeping them. BP02 (handoff cost, High) is the multi-agent tax stated as a line item.
4 practices · BP01 M · BP02 H · BP03 M · BP04 M
AGENTCOST02 — How do you optimize agent model invocation and token consumption costs?
Not every step needs your best model. Routing classification and extraction to a cheap model while reserving the expensive one for judgment calls is usually the largest single saving available, and caching the stable prompt prefix removes the cost of reprocessing the same instructions every turn. Prove each change against your eval set — a saving that drops the pass rate is not a saving.
4 practices · BP01 H · BP02 M · BP03 H · BP04 H
AGENTCOST03 — How do you manage agent memory and state costs efficiently?
Memory has two bills: storing it, and carrying it in every prompt. The second is much larger. Compacting a long transcript into a summary, pruning what the current task does not need, and expiring state on a schedule are cost controls as much as design choices — and deciding what to forget is cheaper than paying to remember it forever.
3 practices · BP01 M · BP02 H · BP03 M
AGENTCOST04 — How do you optimize agent tool invocation?
Agents call tools speculatively, and a metered API called speculatively in a loop is a real bill. Narrowing the toolset so the wrong tool is not an option, caching results that are stable within a run, and failing fast rather than retrying a call that will never succeed all cut invocation counts. Retry policy is a cost policy.
3 practices · BP01 H · BP02 H · BP03 H
AGENTCOST05 — How do you implement cost attribution?
One invoice line reading “model inference” tells you nothing. You need cost per run, per agent and per tenant, which means the same trace that carries latency and errors has to carry token counts — attribution is a tracing problem before it is a finance problem. Once you have it, per-run cost becomes a metric you can alert on. BP03 covers tenant-level allocation for agent-as-a-service pricing; BP04 is chargeback and ROI reporting.
4 practices · BP01 M · BP02 H · BP03 H · BP04 M
AGENTCOST06 — How do you optimize agent discovery registry and deployment costs?
The overhead around the agent counts too: how peers find each other, how many versioned artifacts you keep warm, and what a cold start costs when the first request has to load a model client, a tool catalogue and a memory store. Discovery that re-fetches everything on every call is a recurring tax on a one-time question. BP03 (warm pools, High) is the practice most likely to surprise a team that priced only tokens.
3 practices · BP01 M · BP02 M · BP03 H
AGENTCOST07 — How do you establish agent cost governance and continuous optimization?
A budget with no enforcement is a wish. The control that matters is a hard per-run ceiling — on tokens, iterations and tool calls — that stops the run rather than emailing someone, because a looping agent can spend a month’s budget before a daily alert fires. Anomaly detection on spend catches the class of bug that has no other symptom.
3 practices · BP01 H · BP02 H · BP03 H
Sustainability — AGENTSUS, 3 questions, 13 practices, 5 High
AGENTSUS01 — How do you build sustainable and repeatable frameworks for managing compute, memory, and other shareable agent resources?
Reuse beats rebuild. An agent with explicit resource boundaries, built out of workflow patterns you already use and services several agents share, consumes less of everything than a bespoke one — and BP04 asks it to scale its reasoning to the difficulty of the task instead of running a maximal pipeline on a trivial request. BP05 (specification-driven tasks, High) is the practice to notice: for long-running work, the written spec is the artifact, not the prompt.
5 practices · BP01 H · BP02 M · BP03 M · BP04 H · BP05 H
AGENTSUS02 — How do I establish sustainable frameworks for agent dependencies?
The same efficiency moves as the cost pillar, viewed as resource consumption rather than spend: carry less context, cache what is stable, and size the data and compute behind the agent to what it actually retrieves. The one genuinely distinct practice is BP04 — measuring the environmental footprint of the workload — which most teams never attempt, and which is the only environmental practice in the entire lens.
4 practices · BP01 M · BP02 M · BP03 M · BP04 M
AGENTSUS03 — How do I establish durable patterns for agent interactions with users and business processes?
The lens’s most under-appreciated question. An agent only its authors understand is a liability, and a team that has automated away a skill cannot supervise the automation — so BP01 (High) asks you to retain the human competence the agent depends on, and BP03 (High) to keep specifications current rather than letting the prompt become the only description of intended behaviour. BP04: decommission unused agents, because an unowned agent still holds credentials.
4 practices · BP01 H · BP02 M · BP03 H · BP04 M
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.