How it works
What runs where inside your AWS account, and what happens between a sent message and a finished answer.
Decision-makers Architects ECV operators Engineers Overview 3 min read
This tab explains the machinery behind the portal: the hosts and gateways a deployment runs, how people are signed in, how an agent works through a turn, and how documents become searchable knowledge. Each deployment serves one organisation and runs inside that customer’s own AWS account.
Start with the architecture overview if you want the whole picture on one page. For the rules that decide who pays, who can and who sees, read Concepts instead.
Read this first
Pick the path that matches why you’re here. Each list is in reading order.
- Architecture overview — the components, the nine layers and what leaves your account.
- Deployment requirements — what your infrastructure team provides, and what runs where.
- Data ownership and lifecycle — who owns each kind of data, and what happens when it is deleted.
- Deployment requirements — the readiness checklist, hosts, schemas and configuration.
- Identity — Keycloak, Entra ID and provisioning.
- Model catalog — Bedrock credentials, IAM permissions and how the gateway is kept in step.
- The agentic loop — model calls, tools and effort inside one turn.
- Turn lifecycle — from a posted message to a terminal state, with replay.
- Agent execution — offered tools, trace rows and the two pauses.
- Agent tools — the tool catalog and how tools are registered.
Overview
Platform
Deployment requirements What a deployment provides, and what runs where. Model catalog Models, credentials, BYOK and gateway reconciliation. Applications & MCP gateway How permitted MCP servers reach agents, and how people sign in to them.
Identity
Identity Keycloak brokering Entra ID, and what a request carries. Sign-in The sign-in flow, recovery from a failed login, and the sign-in screens. Organisation and seats First-run setup, invitations, and the seat each person holds. SCIM provisioning How your provider pushes people and groups.
Agent runtime
The agentic loop Many model calls per turn, tools and effort levels. Turn lifecycle Posted message to finished answer, with replay. Pausing and stopping Resuming after a pause, Stop, and steering a running turn. Building the prompt Instructions, short-term memory and compaction. Agent execution Offered tools, trace rows and the two pauses.
Agent tools
Agent tools The tool catalog and how tools are registered. Tool rules Batching, retries and untrusted output. Workspace and code The conversation workspace and code runs. Memory, documents and web Searching memory and knowledge, and reading the web. Artifacts and skills Saving artifacts, loading skills and the task list.
Knowledge
Knowledge pipeline How a document becomes searchable passages. SharePoint sync Pulling SharePoint folders into knowledge bases. File formats What each file type yields, and how. Chunking and sections How text is cut into passages and sections. Retrieval How a search finds and cites passages.