AWS bounded its Bedrock agent to defined API actions

The conversation

On 26 July 2023, AWS published a news blog post titled "Preview – Enable Foundation Models to Complete Tasks With Agents for Amazon Bedrock," opening a preview of a managed service letting a foundation model call a company's own systems to complete a task. The post describes an agent that can "understand user requests, break down complex tasks into multiple steps, carry on a conversation to collect additional information, and take actions to fulfill the request." AWS states the capability was "currently available in preview," meaning access was limited and the interface could still change before general release.

What the documents show

The 2023 post defines an "action group" as two paired artifacts a developer supplies: an OpenAPI schema describing available API operations, and a Lambda function carrying out the business logic behind each operation named in that schema. Orchestration, the post says, follows a ReAct-style pattern, "a sequence of question-thought-action-observation examples," letting the model decide which Lambda functions to invoke and in what order. Retrieved 16 September 2026, the current Bedrock Agents documentation describes the same shape more broadly: agents "orchestrate interactions between foundation models ... data sources, software applications, and user conversations," call APIs automatically, and can be paired with a knowledge base. It also flags a status change since 2023: it labels the original service "Amazon Bedrock Agents Classic," states it "is no longer open to new customers," and points customers toward a successor, Amazon Bedrock AgentCore.

The system boundary

The action-group design draws a firm boundary between what the model decides and what runs: the model's role, per both documents, is to choose which defined action to call and with what parameters, while the named Lambda function, ordinary application code a developer wrote and controls, performs the operation. Bedrock, the documentation states, "manages prompt engineering, memory, monitoring, encryption, user permissions, and API invocation" around that call, but it is the developer's own schema that limits which operations exist to be called at all. Nothing in either document states today's AgentCore-era service behaves identically to the 2023 preview; the maintenance-mode notice is itself evidence it does not.

Where it fails

An agent limited to a defined action group can still choose the wrong action, supply the wrong parameters, or misread an ambiguous request as needing an action it should not take, and the inspectable trace exists precisely because that reasoning is not guaranteed sound. A service now in "maintenance mode" raises a further question: a team that built on the 2023 preview is reading documentation about a product AWS is steering customers away from.

• Does the action group's OpenAPI schema restrict the agent to operations safe to run without a human check?
• Has the trace of the agent's reasoning been reviewed for a specific request, or only spot-checked in testing?
• Is the service version in use still open to new customers, or has AWS moved it to a migration path?

Read side by side, the 2023 preview post and the 2026 documentation describe the same mechanism, model reasoning bounded by developer-defined actions, while showing the product built on it has already changed status once.