AWS Bedrock AgentCore: Observability Architecture for AI-Driven Merchant Banking Application Intake

                    ┌─────────────────────┐
                    │  What type of       │
                    │  business?          │
                    └──────────┬──────────┘
                               │
        ┌──────────────────────┼──────────────────────┐
        ▼                      ▼                      ▼
   Restaurant             E-commerce            Professional
        │                      │                  Services
        ▼                      ▼                      ▼
   Recommend POS          Recommend             Recommend
   terminal + tips        payment gateway       virtual terminal
        │                      │                      │
        ▼                      ▼                      ▼
   Need tableside?        Shopping cart?        Invoice or
   Counter? Both?         platform?             key-in?
        │                      │                      │
        └──────────────────────┼──────────────────────┘
                               │
                    ┌──────────┴──────────┐
                    │  Expected monthly   │
                    │  volume?            │
                    └──────────┬──────────┘
                               │
        ┌──────────────────────┼──────────────────────┐
        ▼                      ▼                      ▼
   <$10K/month            $10K-$50K              >$50K
   Standard rates        Volume discount        Custom pricing
        │                      │                      │
        └──────────────────────┼──────────────────────┘
                               │
                               ▼
                    Risk profile determines
                    documentation requirements...

Agent:
  FoundationModel: anthropic.claude-3-5-sonnet-20241022-v2:0
  IdleSessionTTL: 1800  # 30 minutes - merchants may need to locate documents
  
  InstructionConfiguration:
    Instruction: |
      You are a merchant services application specialist. Guide business 
      owners through payment processing applications.
      
      CRITICAL BEHAVIORS:
      - Validate all data in real-time before proceeding
      - Never skip compliance checks regardless of merchant requests
      - If verification fails, explain clearly and offer alternatives
      - Escalate to human review for: high-risk MCCs, verification 
        failures, complex multi-location setups
      
      CONVERSATION FLOW:
      1. Understand business type and needs → recommend product
      2. Collect and validate business information
      3. Verify owner/principal identity (KYC)
      4. Run compliance screening (OFAC, PEP)
      5. Collect and process required documents
      6. Generate pricing and submit application
      
      BEFORE COLLECTING DOCUMENTS:
      - Always check if documents are already on file
      - If exists, compare for material changes before requesting new
      
      BEFORE STARTING APPLICATION:
      - Check for existing pending or recent applications
      - Offer to check status or continue existing if found

ActionGroup: ProductSelection
Tools:
  - Name: RecommendProduct
    Description: Recommend payment processing products based on business needs
    Parameters:
      - business_type: string (restaurant, retail, ecommerce, services, etc.)
      - monthly_volume: number
      - sales_channel: string (in-person, online, phone, mixed)
      - mobility_needs: boolean
    Returns: Ranked list of product recommendations with rationale
    Backend: Lambda → DynamoDB product catalog + rules engine
    
  - Name: GetProductDetails
    Description: Get specifications and pricing for a specific product
    Parameters:
      - product_id: string
    Returns: Features, specifications, pricing tiers, compatibility info
    Backend: Lambda → DynamoDB + S3 (product documentation)
    
  - Name: CalculatePricing
    Description: Estimate monthly costs based on transaction patterns
    Parameters:
      - product_id: string
      - monthly_volume: number
      - average_ticket: number
      - transaction_count: number
    Returns: Itemized monthly cost breakdown
    Backend: Lambda → Pricing rules engine

ActionGroup: BusinessVerification
Tools:
  - Name: ValidateTIN
    Description: Verify EIN or SSN format and match against business name
    Parameters:
      - tin_type: string (EIN, SSN)
      - tin_value: string
      - legal_business_name: string
    Returns: Validity status, match result, suggested corrections
    Backend: Lambda → IRS TIN Matching API
    
  - Name: VerifyBusinessRegistration
    Description: Check business entity registration with state
    Parameters:
      - business_name: string
      - state: string
      - entity_type: string (LLC, Corp, Sole Prop, etc.)
    Returns: Registration status, formation date, standing, registered agent
    Backend: Lambda → State Secretary of State APIs (varies by state)
    
  - Name: LookupMCC
    Description: Determine Merchant Category Code based on business description
    Parameters:
      - business_description: string
      - products_services: string
      - sales_channel: string
    Returns: Recommended MCC, description, risk tier, required documentation
    Backend: Lambda → MCC classification model
    
  - Name: ValidateAddress
    Description: Standardize and verify business address
    Parameters:
      - street: string
      - city: string
      - state: string
      - zip: string
    Returns: Standardized address, deliverability score, corrections applied
    Backend: Lambda → USPS Address Validation API

ActionGroup: KYCCompliance
Tools:
  - Name: VerifyIdentity
    Description: KYC identity verification for business owner/principal
    Parameters:
      - full_name: string
      - ssn: string
      - date_of_birth: string
      - address: object
    Returns: Verification status, confidence score, flags, verification source
    Backend: Lambda → Third-party KYC provider (Jumio, Onfido, Socure, etc.)
    Note: Returns verification result, not raw identity data
    
  - Name: ScreenOFAC
    Description: Screen individual and business against OFAC sanctions lists
    Parameters:
      - individual_name: string
      - business_name: string
      - country: string
    Returns: Match found (boolean), match details, lists checked, screening ID
    Backend: Lambda → Treasury OFAC API or sanctions screening service
    Compliance: Federal regulatory requirement - cannot be skipped
    
  - Name: CheckPEP
    Description: Screen for Politically Exposed Persons
    Parameters:
      - full_name: string
      - date_of_birth: string
      - country: string
    Returns: PEP status, position details, risk level
    Backend: Lambda → PEP screening service
    
  - Name: AssessRisk
    Description: Calculate preliminary risk score for underwriting
    Parameters:
      - mcc: string
      - monthly_volume: number
      - business_age_years: number
      - owner_credit_indicator: string
    Returns: Risk tier, required documentation, manual review flag
    Backend: Lambda → Risk scoring model

ActionGroup: Documents
Tools:
  - Name: CheckExistingDocuments
    Description: Check if required document is already on file for this entity
    Parameters:
      - application_id: string
      - document_type: string (drivers_license, voided_check, articles, etc.)
    Returns: Exists (boolean), document_id, upload_date, expiration_status
    Backend: Lambda → DynamoDB document registry
    Purpose: Avoid re-collecting documents already on file
    
  - Name: CompareDocuments
    Description: Compare newly uploaded document against existing version
    Parameters:
      - application_id: string
      - document_type: string
      - new_document_s3_uri: string
    Returns: Changes detected, change summary, recommendation (use_new/keep_existing)
    Backend: Lambda → Textract + comparison logic
    Purpose: Determine if new document has material changes worth updating
    
  - Name: ProcessDocument
    Description: Extract structured data from uploaded document image
    Parameters:
      - document_s3_uri: string
      - document_type: string
      - expected_fields: array
    Returns: Extracted fields, confidence scores, validation status
    Backend: Lambda → Amazon Textract (AnalyzeDocument API)
    
  - Name: ValidateDocumentData
    Description: Compare extracted document data against application data
    Parameters:
      - extracted_fields: object
      - application_data: object
    Returns: Match status, discrepancies found, fields requiring confirmation
    Backend: Lambda → Field matching logic

ActionGroup: ApplicationManagement
Tools:
  - Name: CheckExistingApplications
    Description: Find any existing applications for this business/owner
    Parameters:
      - tin: string
      - owner_ssn_last4: string
      - business_name: string
    Returns: Applications found (array), status of each, recommendation
    Backend: Lambda → DynamoDB applications table
    Purpose: Detect pending, approved, or recently declined applications
    
  - Name: SaveApplicationProgress
    Description: Persist current application state for session recovery
    Parameters:
      - application_id: string
      - current_phase: string
      - collected_data: object
    Returns: Save confirmation, resume_token
    Backend: Lambda → DynamoDB
    
  - Name: ResumeApplication
    Description: Retrieve saved application state
    Parameters:
      - resume_token: string
      # OR
      - tin: string
      - owner_verification: object  # Light verification to resume
    Returns: Application state, next required fields, conversation context
    Backend: Lambda → DynamoDB
    
  - Name: SubmitApplication
    Description: Submit completed application to underwriting queue
    Parameters:
      - application_id: string
    Returns: Submission confirmation, reference number, expected timeline
    Backend: Lambda → SQS (underwriting queue) + DynamoDB status update
    Prerequisites: All required fields validated, compliance checks passed
    
  - Name: ScheduleCallback
    Description: Escalate to human representative
    Parameters:
      - application_id: string
      - reason: string
      - preferred_time: string
      - phone_number: string
    Returns: Callback scheduled confirmation, reference number
    Backend: Lambda → CRM integration or callback queue

Guardrail:
  Name: MerchantIntakeGuardrail
  
  ContentFilters:
    - Type: HATE
      Strength: HIGH
    - Type: VIOLENCE
      Strength: HIGH
    - Type: SEXUAL
      Strength: HIGH
    - Type: MISCONDUCT
      Strength: HIGH
  
  SensitiveInformationPolicy:
    PIIEntities:
      - Type: SSN
        Action: ANONYMIZE      # Replace with [SSN] in all responses
      - Type: CREDIT_CARD_NUMBER
        Action: BLOCK          # Never include under any circumstances
      - Type: BANK_ACCOUNT_NUMBER
        Action: ANONYMIZE
      - Type: DRIVER_LICENSE
        Action: ANONYMIZE
    
    RegexPatterns:
      - Name: EIN_PATTERN
        Pattern: '\b\d{2}-\d{7}\b'
        Action: ANONYMIZE
      - Name: ROUTING_NUMBER
        Pattern: '\b\d{9}\b'
        Action: ANONYMIZE

  TopicPolicy:
    DeniedTopics:
      - Name: COMPETITOR_DISCUSSION
        Definition: "Discussion of competitor products, pricing, or recommendations"
        Examples:
          - "What about Square or Stripe?"
          - "Is PayPal better?"
        Action: BLOCK
      
      - Name: INVESTMENT_ADVICE
        Definition: "Financial planning or investment recommendations"
        Action: BLOCK
      
      - Name: UNRELATED_BANKING
        Definition: "Personal loans, mortgages, or products unrelated to merchant services"
        Action: BLOCK

  WordPolicy:
    ManagedWordLists:
      - Type: PROFANITY
        Action: BLOCK
    
    CustomWordLists:
      - Words: 
          - "guaranteed approval"
          - "instant approval" 
          - "no credit check required"
        Action: BLOCK  # These phrases create compliance risk

KnowledgeBase:
  Name: MerchantServicesKB
  
  DataSource:
    Type: S3
    BucketArn: arn:aws:s3:::merchant-kb-documents
    InclusionPrefixes:
      - "products/"              # Product specifications and features
      - "pricing/"               # Pricing tiers and rules
      - "compliance/"            # State-specific requirements
      - "mcc-codes/"             # MCC descriptions and risk mappings
      - "faqs/"                  # Common questions and answers
      - "prohibited-businesses/" # Industries not serviced
    
  ChunkingConfiguration:
    Strategy: HIERARCHICAL
    ParentChunkSize: 1500    # Broader context
    ChildChunkSize: 300      # Precise retrieval
    OverlapPercentage: 20
  
  EmbeddingModel: amazon.titan-embed-text-v2
  
  VectorStore:
    Type: OPENSEARCH_SERVERLESS
    CollectionArn: arn:aws:aoss:us-east-1:xxx:collection/merchant-kb
    
  RetrievalConfiguration:
    NumberOfResults: 5
    SearchType: HYBRID  # Combines semantic and keyword search

{
  "timestamp": "2025-01-13T14:32:18.445Z",
  "trace_id": "1-65a2b3c4-abc123def456",
  "session_id": "ses_abc123def456",
  "application_id": "APP-2025-00892",
  "conversation_turn": 12,
  "phase": "kyc_verification",
  
  "tool_invocation": {
    "action_group": "KYCCompliance",
    "tool_name": "ScreenOFAC",
    "invocation_id": "inv_xyz789",
    "input_hash": "sha256:a1b2c3d4e5f6...",
    "input_field_names": ["individual_name", "business_name", "country"],
    "execution_start_ms": 1705156338445,
    "execution_end_ms": 1705156339337,
    "execution_duration_ms": 892,
    "output_summary": {
      "match_found": false,
      "confidence": 1.0,
      "lists_checked": ["SDN", "CONS", "PLC"],
      "screening_id": "scr_abc123"
    },
    "output_hash": "sha256:f6e5d4c3b2a1..."
  },
  
  "context": {
    "preceding_user_message_type": "ssn_provided",
    "agent_reasoning": "User provided owner SSN, initiating compliance screening",
    "tools_called_this_turn": ["VerifyIdentity", "ScreenOFAC", "CheckPEP"],
    "tool_sequence_position": 2
  },
  
  "application_state": {
    "fields_collected": 18,
    "fields_remaining": 4,
    "compliance_checks_completed": ["tin_validation", "business_registration"],
    "documents_collected": ["drivers_license"]
  }
}

┌─────────────────────────────────────────────────────────────────────────────────┐
│                         OBSERVABILITY PIPELINE                                  │
├─────────────────────────────────────────────────────────────────────────────────┤
│                                                                                 │
│  BEDROCK AGENT                                                                  │
│       │                                                                         │
│       ▼                                                                         │
│  CloudWatch Logs (/aws/bedrock/merchant-intake-agent)                          │
│       │                                                                         │
│       ├──────────────────────────────────┐                                     │
│       │                                  │                                     │
│       ▼                                  ▼                                     │
│  CloudWatch Metrics               Subscription Filter                          │
│  (Real-time dashboards)                  │                                     │
│       │                                  ▼                                     │
│       │                           Kinesis Firehose                             │
│       │                                  │                                     │
│       │                                  ▼                                     │
│       │                           Lambda Transform                             │
│       │                           (Enrich + Parquet)                           │
│       │                                  │                                     │
│       │                                  ▼                                     │
│       │                           S3 Data Lake                                 │
│       │                           (Partitioned by date)                        │
│       │                                  │                                     │
│       │                                  ▼                                     │
│       │                           Glue Data Catalog                            │
│       │                                  │                                     │
│       │                                  ▼                                     │
│       │                              Athena                                    │
│       │                                  │                                     │
│       └──────────────────────────────────┼──────────────────────────────────┐ │
│                                          ▼                                  ▼ │
│                                     QuickSight                      EventBridge│
│                                     (Dashboards)                    (Alerts)   │
│                                                                                 │
└─────────────────────────────────────────────────────────────────────────────────┘

DeliveryStream:
  Name: merchant-intake-tool-logs
  
  Source:
    Type: CloudWatchLogsSubscription
    LogGroup: /aws/bedrock/merchant-intake-agent
    FilterPattern: "{ $.tool_invocation.tool_name = * }"
  
  Processing:
    Processors:
      - Type: Lambda
        LambdaArn: arn:aws:lambda:us-east-1:xxx:function:EnrichToolLogs
        BufferSizeInMBs: 1
        BufferIntervalInSeconds: 60
  
  Destination:
    Type: S3
    BucketArn: arn:aws:s3:::merchant-analytics-data-lake
    Prefix: "tool-logs/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/"
    ErrorOutputPrefix: "errors/"
    
    BufferingHints:
      SizeInMBs: 64
      IntervalInSeconds: 300
    
    DataFormatConversion:
      Enabled: true
      InputFormat: JSON
      OutputFormat: PARQUET
      SchemaConfiguration:
        DatabaseName: merchant_analytics
        TableName: tool_invocations
        Region: us-east-1
        CatalogId: !Ref AWS::AccountId

CREATE EXTERNAL TABLE merchant_analytics.tool_invocations (
  timestamp timestamp,
  trace_id string,
  session_id string,
  application_id string,
  conversation_turn int,
  phase string,
  
  action_group string,
  tool_name string,
  invocation_id string,
  execution_duration_ms int,
  
  input_hash string,
  output_hash string,
  output_summary map<string, string>,
  
  preceding_message_type string,
  agent_reasoning string,
  tool_sequence_position int,
  
  -- Enriched fields (added by Lambda)
  application_outcome string,
  time_to_completion_hours decimal(10,2),
  data_quality_score decimal(3,2)
)
PARTITIONED BY (year string, month string, day string)
STORED AS PARQUET
LOCATION 's3://merchant-analytics-data-lake/tool-logs/'
TBLPROPERTIES ('parquet.compression'='SNAPPY');

-- Which tools are called in each phase, and how do they correlate with success?
SELECT 
  phase,
  tool_name,
  COUNT(*) as invocation_count,
  COUNT(DISTINCT application_id) as applications_using_tool,
  
  -- Success rate when this tool is used in this phase
  AVG(CASE WHEN application_outcome = 'APPROVED' THEN 1.0 ELSE 0.0 END) as approval_rate,
  
  -- Average execution time
  AVG(execution_duration_ms) as avg_latency_ms,
  APPROX_PERCENTILE(execution_duration_ms, 0.95) as p95_latency_ms
  
FROM merchant_analytics.tool_invocations
WHERE year = '2025' AND month = '01'
  AND application_outcome IS NOT NULL
GROUP BY phase, tool_name
ORDER BY phase, invocation_count DESC;

-- Critical: Are compliance tools showing appropriate importance?
-- Alert if OFAC or KYC tools have low correlation with outcomes

WITH compliance_tools AS (
  SELECT 
    application_id,
    MAX(CASE WHEN tool_name = 'ScreenOFAC' THEN 1 ELSE 0 END) as ofac_called,
    MAX(CASE WHEN tool_name = 'VerifyIdentity' THEN 1 ELSE 0 END) as kyc_called,
    MAX(CASE WHEN tool_name = 'CheckPEP' THEN 1 ELSE 0 END) as pep_called
  FROM merchant_analytics.tool_invocations
  WHERE phase = 'kyc_verification'
    AND year = '2025' AND month = '01'
  GROUP BY application_id
),
outcomes AS (
  SELECT DISTINCT application_id, application_outcome
  FROM merchant_analytics.tool_invocations
  WHERE application_outcome IS NOT NULL
)
SELECT 
  'ScreenOFAC' as tool,
  SUM(ofac_called) as times_called,
  COUNT(*) as total_applications,
  CAST(SUM(ofac_called) AS DECIMAL(10,2)) / COUNT(*) as call_rate,
  -- This should be very close to 1.0 - if not, investigate
  CASE 
    WHEN CAST(SUM(ofac_called) AS DECIMAL(10,2)) / COUNT(*) < 0.95 
    THEN 'ALERT: OFAC not called in >5% of applications'
    ELSE 'OK'
  END as status
FROM compliance_tools c
JOIN outcomes o ON c.application_id = o.application_id

UNION ALL

SELECT 
  'VerifyIdentity' as tool,
  SUM(kyc_called),
  COUNT(*),
  CAST(SUM(kyc_called) AS DECIMAL(10,2)) / COUNT(*),
  CASE 
    WHEN CAST(SUM(kyc_called) AS DECIMAL(10,2)) / COUNT(*) < 0.95 
    THEN 'ALERT: KYC not called in >5% of applications'
    ELSE 'OK'
  END
FROM compliance_tools c
JOIN outcomes o ON c.application_id = o.application_id;

-- Do slow tools cause abandonment?
WITH session_metrics AS (
  SELECT 
    session_id,
    application_id,
    MAX(conversation_turn) as total_turns,
    SUM(execution_duration_ms) as total_tool_latency_ms,
    AVG(execution_duration_ms) as avg_tool_latency_ms,
    MAX(application_outcome) as outcome
  FROM merchant_analytics.tool_invocations
  WHERE year = '2025' AND month = '01'
  GROUP BY session_id, application_id
)
SELECT 
  CASE 
    WHEN avg_tool_latency_ms < 500 THEN '0-500ms'
    WHEN avg_tool_latency_ms < 1000 THEN '500-1000ms'
    WHEN avg_tool_latency_ms < 2000 THEN '1000-2000ms'
    ELSE '>2000ms'
  END as latency_bucket,
  COUNT(*) as sessions,
  AVG(CASE WHEN outcome IS NULL THEN 1.0 ELSE 0.0 END) as abandonment_rate,
  AVG(total_turns) as avg_conversation_length
FROM session_metrics
GROUP BY 1
ORDER BY 1;

-- Simplified importance scoring
-- Full Shapley computation runs as separate batch job

WITH tool_presence AS (
  SELECT 
    application_id,
    tool_name,
    1 as tool_used
  FROM merchant_analytics.tool_invocations
  WHERE year = '2025' AND month = '01'
  GROUP BY application_id, tool_name
),
all_apps AS (
  SELECT DISTINCT application_id, application_outcome
  FROM merchant_analytics.tool_invocations
  WHERE application_outcome IS NOT NULL
    AND year = '2025' AND month = '01'
),
tool_outcomes AS (
  SELECT 
    t.tool_name,
    a.application_id,
    a.application_outcome,
    COALESCE(tp.tool_used, 0) as tool_used
  FROM all_apps a
  CROSS JOIN (SELECT DISTINCT tool_name FROM tool_presence) t
  LEFT JOIN tool_presence tp 
    ON a.application_id = tp.application_id 
    AND t.tool_name = tp.tool_name
)
SELECT 
  tool_name,
  
  -- Approval rate when tool IS used
  AVG(CASE WHEN tool_used = 1 AND application_outcome = 'APPROVED' THEN 1.0
           WHEN tool_used = 1 THEN 0.0 
           ELSE NULL END) as approval_rate_with_tool,
  
  -- Approval rate when tool is NOT used
  AVG(CASE WHEN tool_used = 0 AND application_outcome = 'APPROVED' THEN 1.0
           WHEN tool_used = 0 THEN 0.0
           ELSE NULL END) as approval_rate_without_tool,
  
  -- Importance proxy: difference in approval rates
  AVG(CASE WHEN tool_used = 1 AND application_outcome = 'APPROVED' THEN 1.0
           WHEN tool_used = 1 THEN 0.0 
           ELSE NULL END) -
  AVG(CASE WHEN tool_used = 0 AND application_outcome = 'APPROVED' THEN 1.0
           WHEN tool_used = 0 THEN 0.0
           ELSE NULL END) as importance_proxy

FROM tool_outcomes
GROUP BY tool_name
HAVING COUNT(CASE WHEN tool_used = 1 THEN 1 END) > 10  -- Minimum sample size
ORDER BY importance_proxy DESC;

Rule:
  Name: ComplianceToolAlert
  Description: Alert when compliance tools show low usage or importance
  
  EventPattern:
    source:
      - "custom.merchant-analytics"
    detail-type:
      - "ComplianceMetricBreach"
    detail:
      metric_name:
        - "ofac_call_rate"
        - "kyc_call_rate"
        - "compliance_tool_importance"
      breach_type:
        - "below_threshold"
  
  Targets:
    - Id: SNSAlert
      Arn: arn:aws:sns:us-east-1:xxx:compliance-alerts
    - Id: PagerDuty
      Arn: arn:aws:events:us-east-1:xxx:api-destination/pagerduty

Merchant: "I'd like to apply for a payment terminal"

Agent: [Calls CheckExistingApplications]
       [Returns: 1 pending application from 5 days ago]

Agent: "I found an existing application for Tasty Tacos LLC that you 
        submitted on January 8th. It's currently in underwriting review.
        
        Would you like me to:
        • Check the status of that application, or
        • Start a new application for a different location or product?"

Agent: "I'll need a copy of your driver's license for identity verification."

Merchant: [Uploads driver's license image]

Agent: [Calls CheckExistingDocuments → found existing from prior app]
       [Calls CompareDocuments → detects address change]

Agent: "I see we have a driver's license on file from your previous 
        application, but the address is different. Your new license 
        shows 456 Oak Street instead of 123 Main Street.
        
        Should I update your business address to match?"

Agent: [Calls VerifyIdentity → returns FAILED, confidence 0.3]

Agent: "I wasn't able to verify your identity with the information 
        provided. This sometimes happens when:
        
        • The Social Security Number has a typo
        • Your name doesn't match exactly (maiden name, suffix, etc.)
        • Your address doesn't match credit bureau records
        
        Would you like to:
        • Re-enter your information, or
        • Speak with a specialist who can help verify manually?
        
        I can schedule a callback if that's easier."

┌─────────────────────────────────────────────────────────────────────────────────┐
│                    MERCHANT INTAKE AGENT - COMPLETE ARCHITECTURE                │
├─────────────────────────────────────────────────────────────────────────────────┤
│                                                                                 │
│  PRESENTATION                                                                   │
│  ┌─────────────────────────────────────────────────────────────────────────┐   │
│  │  CloudFront ──▶ S3 (React SPA) ──▶ API Gateway (WebSocket)             │   │
│  └─────────────────────────────────────────────────────────────────────────┘   │
│                                          │                                      │
│                                          ▼                                      │
│  AGENT LAYER                                                                    │
│  ┌─────────────────────────────────────────────────────────────────────────┐   │
│  │                      AWS BEDROCK AGENTCORE                              │   │
│  │  ┌───────────────────────────────────────────────────────────────────┐ │   │
│  │  │  Agent: Claude 3.5 Sonnet                                         │ │   │
│  │  │  Knowledge Base: S3 → Titan Embeddings → OpenSearch Serverless    │ │   │
│  │  │  Guardrails: PII filtering, topic blocking, word policies         │ │   │
│  │  │  Session Memory: DynamoDB-backed                                  │ │   │
│  │  └───────────────────────────────────────────────────────────────────┘ │   │
│  │                                  │                                      │   │
│  │  ┌───────────────────────────────┼───────────────────────────────────┐ │   │
│  │  │                    ACTION GROUPS                                  │ │   │
│  │  │                                                                   │ │   │
│  │  │  ProductSelection │ BusinessVerify │ KYCCompliance │ Documents   │ │   │
│  │  │  ApplicationMgmt  │                                              │ │   │
│  │  │                                                                   │ │   │
│  │  └───────────────────────────────┼───────────────────────────────────┘ │   │
│  └──────────────────────────────────┼──────────────────────────────────────┘   │
│                                     │                                          │
│  COMPUTE LAYER                      ▼                                          │
│  ┌─────────────────────────────────────────────────────────────────────────┐   │
│  │                         AWS LAMBDA FUNCTIONS                            │   │
│  │                    (Tool implementations + integrations)                │   │
│  └─────────────────────────────────────────────────────────────────────────┘   │
│                    │                │                │                         │
│  DATA LAYER        ▼                ▼                ▼                         │
│  ┌──────────────────────────────────────────────────────────────────────────┐  │
│  │  DynamoDB          S3                Secrets Manager    External APIs    │  │
│  │  • Sessions        • Documents       • API credentials  • IRS TIN        │  │
│  │  • Applications    • KB source       • KYC provider     • State SOS      │  │
│  │  • Tool logs       • Analytics       • OFAC service     • KYC/IDV        │  │
│  │                                                         • OFAC           │  │
│  └──────────────────────────────────────────────────────────────────────────┘  │
│                                                                                 │
│  OBSERVABILITY LAYER                                                           │
│  ┌──────────────────────────────────────────────────────────────────────────┐  │
│  │                                                                          │  │
│  │  CloudWatch ──▶ Kinesis Firehose ──▶ S3 (Parquet) ──▶ Athena            │  │
│  │       │                                                   │              │  │
│  │       │                     ┌─────────────────────────────┤              │  │
│  │       │                     │                             │              │  │
│  │       ▼                     ▼                             ▼              │  │
│  │  CloudWatch            QuickSight                   EventBridge          │  │
│  │  Dashboards            Dashboards                   Alerts               │  │
│  │  (Real-time)           (Analytics)                  (Compliance)         │  │
│  │                                                                          │  │
│  └──────────────────────────────────────────────────────────────────────────┘  │
│                                                                                 │
└─────────────────────────────────────────────────────────────────────────────────┘