The Monovus Blueprint

Delegation at machine speed

Water systems, hospitals and pension funds run on people handing work to others they can’t watch, and signatures, job descriptions, ledgers and audits make that safe. Companies pay for that oversight in approvals, reviews and audits, a price Jensen and Meckling named agency costs in 1976. Delegating a task never hands over the responsibility for it, so the people who answer for the work have to be able to see it.

AI agents are a new kind of delegate: they read what a company knows, decide and act at software speed, with none of the oversight built for people. A model follows its instructions most of the time, but a company’s rules have to hold every time, so the seven controls in this Blueprint are checked on every action, inside the company’s own AWS account.

The reasons Gartner gives are escalating costs, unclear business value or inadequate risk controls.

Who is it acting as?

What people have

An employee ID and a signature

What an agent needs

Its own identity

How it’s enforced

A named role with its own credentials. No shared keys.

On AWS

• Amazon Bedrock AgentCore Identity
• AWS IAM roles
• AWS Secrets Manager

What good looks like

• The agent has its own role, with only the permissions its tools need.
• When it acts for a signed-in user, the systems it reaches see that user, not a shared admin account or service account.
• Every password and API key is in AWS Secrets Manager, rotated automatically, with access logged. None is in code, configuration files or environment variables.

What we check

• When the agent acts in another system, whose identity does it use?
• Where are its passwords and API keys kept?

Without it

SimulatedThe agent acted with a shared admin key.If you can’t say who the agent acted as, you can’t answer an auditor, and one leaked key can expose every system it touches.

What is it allowed to do?

What people have

A job description and a signing limit

What an agent needs

A mandate

How it’s enforced

Every action, and every source it reads, is checked against written rules first. Above a limit, it waits for a person.

On AWS

• Amazon Bedrock AgentCore Policy, with rules checked at the AgentCore Gateway before each tool runs
• AgentCore Gateway
• Least-privilege AWS IAM
• Amazon Bedrock Guardrails, for content

What good looks like

• Every action the agent can take is listed, and the ones it doesn’t need are removed.
• Its rules are written down, tested, and checked outside the prompt before each tool runs.
• Anything above a set limit, such as a refund over the approval amount, waits for a person to approve it.

What we check

• What can the agent change in your systems?
• Are its rules enforced by instructions in the prompt, or by checks outside the model?

Without it

SimulatedA refund of $1,240 was issued without approval.A prompt is a request, not a control. A confused or manipulated agent can take actions that are expensive or impossible to undo.

What did it just do, and why?

What people have

Minutes and ledgers

What an agent needs

A record

How it’s enforced

Every step is traced, down to the source it relied on.

On AWS

• AgentCore Observability, with OpenTelemetry traces
• Amazon CloudWatch

What good looks like

• The trace of each request shows every step: what the model was asked, which tools it used and what data it retrieved.
• For any complaint, someone on your team can open the trace of that request and see why the agent acted.
• An alarm on the error rate flags a failing agent within minutes, without anyone watching a dashboard.

What we check

• If a customer complains about an answer, can your team see exactly what the agent did and why?
• How quickly would you notice if the agent started failing?

Without it

SimulatedA complaint arrives. There is no record of what the agent did.When something goes wrong and you can’t explain it, a fixable bug becomes a question of trust with customers and leadership.

Is it still right after the next release?

What people have

Probation and performance reviews

What an agent needs

Review before trust

How it’s enforced

Each new version is tested on fixed cases and blocked if it scores below the bar.

On AWS

• AgentCore Evaluations
• A fixed set of test cases
• A release gate in the deployment pipeline

What good looks like

• A fixed set of real questions with known good answers, starting with 25.
• The pipeline runs the set on every change and blocks any version that scores below the agreed bar.
• The rate of wrong or unacceptable answers is measured continuously against a target.

What we check

• Before a change goes live, how do you check the agent hasn’t got worse?
• Do you know how often it gives a wrong or unacceptable answer today?

Without it

SimulatedVersion 1.6 shipped at 88.9%, below the 92% bar.A prompt edit or a model upgrade can make answers worse, and you find out from a customer.

What will it cost next month?

What people have

An expense limit

What an agent needs

A budget

How it’s enforced

Spend is metered per agent, with alarms and hard limits.

On AWS

• AWS Budgets
• Amazon CloudWatch alarms
• Model routing in Amazon Bedrock, with a small model first

What good looks like

• The cost of one task is measured for each agent, not only the monthly total.
• Each agent has a monthly budget with alarms at 50%, 80% and 100%, and a hard limit per user or per task.
• Simple turns go to a smaller model first, and only the turns that need it reach a larger one.

What we check

• Do you know what one conversation or task costs to run?
• What stops AI usage costs from running away?

Without it

SimulatedSpend passes the monthly budget on day 19.Usage can grow faster than value. A popular launch or a looping agent can produce a bill nobody approved.

How fast can a bad release be undone?

What people have

A way to correct or recall work

What an agent needs

A way back

How it’s enforced

Any release can be rolled back in minutes.

On AWS

• Versioned releases on AgentCore Runtime
• Switching an endpoint back to the previous version

What good looks like

• Prompts, tool definitions and settings are in version control, and every change is reviewed and tested.
• Every release is a numbered version, and the last good one is known.
• A rollback has been rehearsed before launch and takes minutes.

What we check

• If a change makes the agent worse, how fast can you return to the last good version?
• Are its prompts, tools and settings under version control?

Without it

SimulatedA bad release stays live for 3 h 20 min.Customers are affected for the whole time someone works out what changed.

Can you show that the rules held?

What people have

An audit file

What an agent needs

Evidence

How it’s enforced

The record is packaged for auditors and security reviews.

On AWS

• AWS CloudTrail
• The trace record
• A runbook

All three organised for security reviews and audits.

What good looks like

• A one-page runbook gives the symptoms, a named owner, how to pause the agent and how to roll it back.
• The runbook has been rehearsed, so an incident doesn’t depend on the person who built the agent.
• Test results, access records and the runbook are kept up to date in one place, ready for a security review, a customer or an auditor.

What we check

• If the agent misbehaves at 9am on a Monday, does your team know what to do?
• If security, a customer or an auditor asked for evidence that the agent is controlled, could you provide it?

Without it

SimulatedThe security review asks for evidence. There is none on file.Launches stall in security review, and incidents depend on one person being available.

Next steps

Score yourself

The Readiness Check scores one of your agents on the questions in this Blueprint, plus two on who owns it and how you’ll know it is worth what it costs. Your report shows your biggest gaps and a 30-day plan.Check your readiness →23 questions · about 5 minutes · in your browser

See it running

The reference architecture inside an AWS account, with a test request you can send through it.See it running →On the Monovus site