AWS just handed platform teams a new attack surface and called it a feature.
This week Bedrock added a new model 'Terra', AgentCore Evaluations gained decision-model evaluation support, and Step Functions can be integrated as agent tools — letting agents call StartExecution on existing state machines that orchestrate hundreds of AWS services. In plain terms: you can now point an LLM agent at your production workflows and let it run them without rewriting those workflows into custom microservices.
That is tremendously powerful and deeply risky.
The trust boundary you didn't model
Exposing Step Functions to agents changes the threat model in three concrete ways. First, the principal calling StartExecution is no longer strictly a human or long-lived service account — it can be an agent runtime acting on behalf of a human prompt or another agent. Second, agents tend to explore and retry; they all workflows in ways humans wouldn't, amplifying blast radius. Third, existing least-privilege patterns — role-per-service, narrowly scoped IAM roles with permission boundaries — assume predictable call patterns. Agents break that assumption.
This isn't academic. Step Functions orchestrate anything from RDS snapshots to DynamoDB writes, Glue jobs to EMR steps. An agent misdirected by ambiguous context can trigger data exfiltration, cost spikes, or destructive maintenance actions. The only reason this hasn't bitten more teams already is that few vendors unified agent runtimes and orchestration this closely.
Platform teams need to stop treating agents as just another developer-facing SDK. Put the controls where State Machine invocations happen:
- Use resource policies on state machines and explicit IAM condition keys (caller identity, session tags) to limit agent-initiated StartExecution.
- Enforce session tagging and short-lived credentials for agent runtimes so each run has an auditable principal.
- Build guardrails in the workflows themselves: require human approval steps for high-impact branches, or instrument responses with approval tokens checked by a separate service.
Yes, this is governance overhead. It lso the right call — the alternative is ad-hoc credential injection and invisible activity in CloudTrail.
Bedrock + AgentCore: production agents are no longer a toy
The new Terra model in Bedrock expands the foundation-model choices for agentic stacks. Higher-capability models are the lever that turns brittle playbooks into systems that can generalize across edge cases. The notable platform change is AgentCore Evaluations adding decision-model-style evaluation: you can now evaluate not just the surface output of an agent, but the decisions it makes, the trade-offs it chooses, and how it weights safety constraints.
Decision-model evaluations are overdue and crucial. If you judge an agent only by text quality (likelihood or ROUGE), you miss whether it prefers cheaper but dangerous options, or whether it consistently escalates to humans. Treating agent evaluation as a policy-testing problem — measurable, repeatable, automatable — is how you move from demos to safe production automation.
A small but meaningful data-platform footer
Amazon S3 table tooling now offers managed assistance for migrating Hive-style table metadata into Apache Iceberg-compatible tables. That reduces operational friction during format migration: schema evolution, atomic commits, and time-travel semantics are easier to manage in Iceberg, removing one more blocker for teams modernizing lakehouse stacks.
What to do tomorrow
Revisit who can call StartExecution and under what conditions. Instrument agent runs with session tags and short-lived identities. Add decision-model tests to CI for any agent that can change state, and hard-fail deployments when agents' decision profiles deviate from approved tolerances. Treat S3 table migrations as a chance to standardize on table-format tooling and reclaim messy ETL glue.
This week est isn't just new features — they're a new operating model. Agents that can natively call orchestration and are testable at the decision level make automation dramatically more capable. They also make governance and testing requirements non-optional. If your platform team treats this as a plug-and-play UX win, you e the team that has to explain why a recommendation agent ran a destructive runbook at 03:00.
For a deeper look at exposing Step Functions to agents, see our walkthrough: [AWS Step Functions Agent Tools
](/article/aws-step-functions-agent-tools-call-existing-workflows/).
Either build the controls now, or expect to build them under fire.