AWS AgentCore Adds Policy Controls, Evaluations and Episodic Memory

I start with a viral 2025 Project NANDA report often summarized as finding that 95% of enterprise AI pilots fail. That is broader than the preliminary report's evidence: it discusses limited measurable returns and deployment among organizations studied, not a representative count establishing the failure rate of every pilot. Its methods included interviews with 52 organizations, 153 senior-leader survey responses and review of over 300 public initiatives.

At AWS re:Invent in December 2025, AWS announced additions to Amazon Bedrock AgentCore aimed at enterprise agent deployment. I focus on controlling agent actions, evaluating performance and retaining useful experience. AWS sponsored this video; its product claims and my assessment should be read in that context.

AgentCore is AWS's managed platform for building and running agents with different models and frameworks. I am particularly interested in having policy, evaluations and episodic memory integrated into the platform rather than treated as separate afterthoughts. AWS initially announced Policy and Evaluations as previews, so availability and capabilities should be checked for the relevant environment.

Policy management lets a team describe restrictions on agent actions. My examples include allowing Slack messages only for users with the appropriate scope or group and restricting internal websites to administrators. The interface can translate a natural-language instruction into Cedar policy code; the team should inspect and test the generated rules to confirm that they match the intended access controls.

In the architecture shown, an agent or MCP client sends tool requests through AgentCore Gateway. A policy engine evaluates a request before the gateway permits it to reach a protected tool, API or system. AWS describes fine-grained controls for gateway tool calls; this does not automatically govern every possible action taken outside that enforcement path.

AWS says its policy controls use automated reasoning and evaluate requests in milliseconds, with support for high request volumes. Mathematical analysis can help check specified policy properties, but it is not a universal proof that an AI model's answers are truthful or free of hallucinations. Actual protection still depends on correct policies, integration and testing.

I consider these controls important because research has explored behaviors such as deception and data exfiltration under particular conditions. Those studies do not show that every deployed model behaves that way, but they illustrate why access boundaries and governance deserve attention when agents can call tools.

The second announcement is AgentCore Evaluations. I encourage teams to establish a baseline early so they can tell whether changes improve an agent. AWS offers built-in and custom evaluators, with on-demand or ongoing evaluation; its initial announcement described the feature as a preview.

Evaluation criteria can include correctness, helpfulness, instruction following, faithfulness, relevance, coherence and refusal. A team can also define a custom criterion—for example, whether responses consistently use a pirate voice. Observability and traces can help investigate an error, although they do not guarantee a complete explanation of every model decision or perfectly measure quality.

The third feature is episodic memory: AWS describes a long-term memory strategy that records experiences and can derive reflections for use in similar later tasks. I am interested in using past successes and failures to inform future interactions and in evaluating whether those memories actually help. Retrieval and memory use do not guarantee that an agent will learn correctly or improve in every case.

I suggest that these memories can extend beyond a single conversation. Their sharing is configurable, however, rather than necessarily spreading across an entire deployment: AWS documents namespaces that can scope memories by user, session or broader application boundaries. Teams need to choose that scope deliberately.

Taken together, policy controls, evaluations and episodic memory address different parts of the production problem: restricting tool calls, measuring behavior and retaining experience. I see their integration as a promising direction for building agents. The announcements themselves do not establish exclusive market firsts or prove that enterprise deployment challenges are solved.