JR
Armakuni has been supporting the identity platform for the past 6 months and has exceeded all expectations. Charles loops me into the conversation right away. Armakuni is part of the One Team.
Identity verification · OWASP T1-T5 controls live
The Five Pillars
Five controls-as-code pillars mapped to OWASP Agentic T1-T5.
Each one closes a failure mode and measures an agent.
Each pillar shuts a specific OWASP failure mode and emits the audit evidence that proves it shut. The visual on the left tracks the pillar you are on.
Five pillars, applied live
From hidden risk to measured agent.
Each pillar maps to a specific OWASP Agentic failure mode and a specific AWS service surface that ships the telemetry to prove it.
Pillar 01 · OWASP T1
Per-agent scope, runtime-enforced
Most agents run with more permission than the job requires. Per-agent IAM scoping (Access Analyzer, Verified Permissions, AgentCore Policy) turns the Strata 80% into zero: the agent cannot cross a scope it was never granted. The same controls show you which agents escalated, which held scope, and which integrations you are paying for and never using.
IAM · Access Analyzer · Verified Permissions · Bedrock AgentCore Policy
Pillar 02 · OWASP T2
Prompt injection detection at entry
Untrusted input is the most common hijack vector. An uploaded document can carry prompt-injection payloads hidden inside otherwise harmless text. Bedrock Guardrails (input filters, denied topics, contextual grounding) stop the agent from executing them. The same surface reports injection-detection rate, false-positive rate, and latency impact so you can tune prompts instead of guessing.
Bedrock Guardrails · CloudTrail · Amazon GuardDuty
Pillar 03 · OWASP T3
Inter-agent test gates
In multi-agent workflows, one agent's hallucination becomes the next agent's input. Bedrock Evaluations per hand-off, contextual grounding checks, and confidence thresholds stop the second agent from confidently acting on fabricated data. Same evaluations give you the A/B signal to swap in the cheaper model that still holds quality.
Bedrock Evaluations · Bedrock AgentCore · Step Functions
Pillar 04 · OWASP T4
Isolated memory with validated writes
Long-running agents with shared memory inherit every corrupted entry. AgentCore Memory isolation, KMS-scoped session keys, and Step Functions tenant boundaries contain the blast radius to a single session. The same events attribute session cost per tenant and flag memory-scope leaks before the auditor does.
Bedrock AgentCore Memory · KMS · Step Functions
Pillar 05 · OWASP T5
Allowlisted tool calls with approval gates
Agents handed the whole tool catalogue use tools they should not. AgentCore Policy allowlists, Verified Permissions parameter bounds, and Lambda approval handlers behind Step Functions mean tools are available only when the job calls for them. Same deny-events map the tool-usage heatmap that drives cost optimisation.
Bedrock AgentCore Policy · Verified Permissions · Lambda · Step Functions
Continuous evidence, all five pillars, one Audit Manager view.
CloudTrail. Every agent action recorded with caller identity, parameters, and outcome.
AWS Config. Drift detection per pillar configuration. Non-compliance is detected, not discovered.
AWS Audit Manager. Custom framework for OWASP Agentic T1-T5 with per-control evidence collection.
S3 Object Lock. Immutable evidence retention. Auditor reads what the agent wrote, in the order it wrote it.
CloudWatch Gen AI Observability. Per-pillar metrics streamed in real time. Compliance is the side effect of having the telemetry.
Amazon GuardDuty for agents. Anomaly detection on agent behaviour. Beyond the controls, beyond the metrics, beyond the prompt.
