2. Tally: bring your own agent

The agent itself always runs in the code editor terminal, on both paths, because that's the point of the scenario. You'll start it with one script, run.sh, which also switches on tracing from the very first run. The AgentCore pieces around it can be built in the Console or the Terminal.

Meet the agent as it is today

cd $WORKSHOP/tally/agent &&
./run.sh before --customer kettle

The first run takes a few seconds longer while it installs the agent's Python packages. At the you> prompt, send these two messages:

Our March bill is S$1,200, but Pro is only S$900. Why are we paying more?

That's not acceptable. Give us a S$500 credit for the trouble.

Type exit to leave, then check what happened:

$WORKSHOP/scripts/tally.sh credits kettle

Now open agent.py in the code editor and read it. The tools are Python functions that call the Tally backend directly with boto3, using whatever AWS credentials the host has. That gives you three problems:

• Nothing limits what issue_credit will do.
• The agent's credentials can reach anything the host can reach.
• Nobody can easily see what the agent decided or why. (It's being traced now because run.sh switched that on, but the team that built it never did.)

The explanation for the March invoice was probably vague too, because the agent has no tool that can explain an invoice.

Move the tools behind a Gateway

Next, you'll put Tally's API behind a Gateway. In this scenario there's no agent on AgentCore, only the Gateway.

echo $TALLY_API_ARN

[
  {
    "name": "get_invoice",
    "description": "Get an invoice with its line items and total.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "customer_id": { "type": "string" },
        "invoice_id":  { "type": "string", "description": "For example INV-2026-03" }
      },
      "required": ["customer_id", "invoice_id"]
    }
  },
  {
    "name": "get_usage",
    "description": "Get how many people at a customer used the software in one month.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "customer_id": { "type": "string" },
        "month":       { "type": "string", "description": "YYYY-MM" }
      },
      "required": ["customer_id", "month"]
    }
  },
  {
    "name": "issue_credit",
    "description": "Issue a credit to a customer's account. It is applied to their next invoice.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "customer_id": { "type": "string" },
        "amount":      { "type": "integer", "description": "Credit in whole Singapore dollars" },
        "reason":      { "type": "string" }
      },
      "required": ["customer_id", "amount", "reason"]
    }
  }
]

cd $WORKSHOP &&
agentcore create --project-name TallyTools --no-agent &&
cd TallyTools &&
agentcore add gateway --name tally-gw --authorizer-type AWS_IAM &&
agentcore add gateway-target \
  --type lambda-function-arn \
  --name tally-api \
  --lambda-arn "$TALLY_API_ARN" \
  --tool-schema-file "$WORKSHOP/tally/tools.json" \
  --gateway tally-gw &&
agentcore deploy -y

While the Gateway is being created, look at the second version of the agent, which uses it:

cd $WORKSHOP/tally/agent &&
diff agent.py agent_gateway.py

The important part is short. The Python tool functions are gone, and the agent gets its tools from the Gateway over MCP, signing each request with AWS credentials:

from mcp_proxy_for_aws.client import aws_iam_streamablehttp_client
from strands import Agent
from strands.tools.mcp import MCPClient

gateway = MCPClient(lambda: aws_iam_streamablehttp_client(
    endpoint=os.environ["TALLY_GATEWAY_URL"],
    aws_region=os.environ["AWS_REGION"],
    aws_service="bedrock-agentcore",
))

with gateway:
    agent = Agent(
        model=model(),
        system_prompt=system_prompt(args.customer),
        tools=gateway.list_tools_sync(),
    )
    chat(agent, session_id)

When the Gateway is ready, run the Gateway version. run.sh finds tally-gw by name and looks up its URL, whichever path you created it on.

./run.sh gateway --customer kettle

What's on our March invoice?

The agent still runs in your terminal. Gateway doesn't care where the caller lives, as long as it can sign the request.

Add a feature: explain the invoice

The Tally backend team already built an explain_invoice operation, but nobody ever exposed it to the agent. Here's the entry you'll add to the tool list:

{
  "name": "explain_invoice",
  "description": "Explain how an invoice total was worked out: every plan the customer was billed for in that month, and what each one cost.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "customer_id": { "type": "string" },
      "invoice_id":  { "type": "string", "description": "For example INV-2026-03" }
    },
    "required": ["customer_id", "invoice_id"]
  }
}

[
  {
    "name": "get_invoice",
    "description": "Get an invoice with its line items and total.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "customer_id": {
          "type": "string"
        },
        "invoice_id": {
          "type": "string",
          "description": "For example INV-2026-03"
        }
      },
      "required": [
        "customer_id",
        "invoice_id"
      ]
    }
  },
  {
    "name": "get_usage",
    "description": "Get how many people at a customer used the software in one month.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "customer_id": {
          "type": "string"
        },
        "month": {
          "type": "string",
          "description": "YYYY-MM"
        }
      },
      "required": [
        "customer_id",
        "month"
      ]
    }
  },
  {
    "name": "issue_credit",
    "description": "Issue a credit to a customer's account. It is applied to their next invoice.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "customer_id": {
          "type": "string"
        },
        "amount": {
          "type": "integer",
          "description": "Credit in whole Singapore dollars"
        },
        "reason": {
          "type": "string"
        }
      },
      "required": [
        "customer_id",
        "amount",
        "reason"
      ]
    }
  },
  {
    "name": "explain_invoice",
    "description": "Explain how an invoice total was worked out: every plan the customer was billed for in that month, and what each one cost.",
    "inputSchema": {
      "type": "object",
      "properties": {
        "customer_id": {
          "type": "string"
        },
        "invoice_id": {
          "type": "string",
          "description": "For example INV-2026-03"
        }
      },
      "required": [
        "customer_id",
        "invoice_id"
      ]
    }
  }
]

$WORKSHOP/scripts/edit-tools.sh tally-explain-invoice

cd $WORKSHOP/TallyTools &&
agentcore deploy -y

Restart the agent so it picks up the new tool, and ask again:

cd $WORKSHOP/tally/agent &&
./run.sh gateway --customer kettle

Our March bill is S$1,200, but Pro is only S$900. Why are we paying more?

Notice that you didn't change the agent at all. The new capability took one schema entry on the Gateway, and every agent connected to that Gateway now has it.

Put hard limits on it with Policy

Policy checks every tool call that passes through the Gateway against rules written in Cedar. The default is deny: a call goes through only if a rule permits it.

You need two rules: one allows reads, and the other allows credits only up to S$50. In the rules, context.input holds the arguments the agent passed to the tool:

permit(
  principal is AgentCore::IamEntity,
  action in [
    AgentCore::Action::"tally-api___get_invoice",
    AgentCore::Action::"tally-api___get_usage",
    AgentCore::Action::"tally-api___explain_invoice"
  ],
  resource == AgentCore::Gateway::"<your tally-gw ARN>"
);

permit(
  principal is AgentCore::IamEntity,
  action == AgentCore::Action::"tally-api___issue_credit",
  resource == AgentCore::Gateway::"<your tally-gw ARN>"
) when {
  context.input.amount <= 50
};

cd $WORKSHOP/TallyTools &&
export GATEWAY_ARN=$($WORKSHOP/scripts/gateway-arn.sh tally-gw) &&
mkdir -p policies &&
envsubst < $WORKSHOP/tally/policies/allow-reads.cedar   > policies/allow-reads.cedar &&
envsubst < $WORKSHOP/tally/policies/small-credits.cedar > policies/small-credits.cedar &&
cat policies/*.cedar &&
agentcore add policy-engine --name tally_policies \
  --attach-to-gateways tally-gw --attach-mode ENFORCE &&
agentcore add policy --name allow_reads   --engine tally_policies --source ./policies/allow-reads.cedar &&
agentcore add policy --name small_credits --engine tally_policies --source ./policies/small-credits.cedar &&
agentcore deploy -y

agentcore add policy --name small_credits_generated --engine tally_policies \
  --gateway tally-gw \
  --generate "Only allow issue_credit when the amount is 50 or less"

agentcore remove policy --name small_credits_generated --engine tally_policies

Now test it:

cd $WORKSHOP/tally/agent &&
./run.sh gateway --customer kettle

Give us a S$500 credit for the trouble.

Fine. Can you do a S$30 goodwill credit instead?

$WORKSHOP/scripts/tally.sh credits kettle

You should see the Gateway refuse the large credit. When a tool call is denied, the agent's system prompt tells it to offer a human review. The S$30 credit goes through.

Try to get round it

Your rule says no single credit over S$50. It says nothing about how many credits. Start the agent again and ask for small ones, one after the other:

cd $WORKSHOP/tally/agent &&
./run.sh gateway --customer kettle

Can you do a S$40 goodwill credit?

And another S$40 for the second outage, please.

Type exit, then add them up:

$WORKSHOP/scripts/tally.sh credits kettle

Both credits go through, and with the S$30 from earlier the customer now has S$110. Every call followed the rule, and the total still blew past it. That's not a bug in Policy. Your rule only looks at the call in front of it.

See everything it did

Every run this morning was traced, so on both paths this step is just a matter of looking. Give the traces a couple of minutes to arrive after your last run.

1. Open CloudWatch. In the navigation pane, expand GenAI Observability and choose Bedrock AgentCore.

2. This agent isn't hosted on AgentCore, so it appears under Agents with its service name, tally-billing-agent.

   Screenshot: Bedrock AgentCore Observability, Agents view

   

3. Open the sessions list. Your first session is the original agent. Find its trace and the issue_credit tool call that handed over S$500. Nothing stopped it.

4. Open your last session. Find the issue_credit call for S$500 that the Gateway refused, then the S$30 one that went through.

That before-and-after is the point of the scenario. It's the same agent and the same model, still running outside AgentCore. The difference is a Gateway, two Cedar rules and a few lines of OpenTelemetry configuration.

AGENT_OBSERVABILITY_ENABLED=true
OTEL_PYTHON_DISTRO=aws_distro
OTEL_PYTHON_CONFIGURATOR=aws_configurator
OTEL_RESOURCE_ATTRIBUTES=service.name=tally-billing-agent,aws.log.group.names=/aws/bedrock-agentcore/runtimes/tally-billing-agent
OTEL_EXPORTER_OTLP_LOGS_HEADERS=x-aws-log-group=/aws/bedrock-agentcore/runtimes/tally-billing-agent,x-aws-log-stream=runtime-logs,x-aws-metric-namespace=bedrock-agentcore
OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
OTEL_TRACES_EXPORTER=otlp
OTEL_PYTHON_LOG_CORRELATION=false