Agents on Call
An eight-part build log
A mid-size SaaS team builds a multi-agent ops platform on AWS Bedrock, decision by decision.
8 parts
Agents on Call, Part 1. The Scenario: Why an Ops Team Hires Agents
A mid-size SaaS drowns in on-call toil and decides to hire agents. Part 1: the scenario, the stack decision, and the AWS Bedrock architecture we will build.
Agents on Call, Part 2. The Foundation: Terraform Before Tokens
Before a single Bedrock token flows: the ops-tooling account, the two spoke IAM roles, model access, and the inference-profile decision, all in Terraform.
Agents on Call, Part 3. First Agent: Incident Triage in Strands
The first agent ships: a Strands triage agent on AgentCore Runtime, its evidence-first system prompt, two read-only tools, and the Terraform that deploys it.
Agents on Call, Part 4. Tools and the Gateway: MCP, Allowlists, Read-Only Default
Tools move behind AgentCore Gateway: scoped Lambdas, cross-account read-only roles, and the one gated path that is allowed to change anything.
Agents on Call, Part 5. The Team: Supervisor and Three Specialists
A supervisor delegates to triage, runbook, and cost agents over the network, AgentCore Memory ties their findings together, and when one agent still wins.
Agents on Call, Part 6. Guardrails: The Part Everyone Skips
Threat model, then guardrails: Bedrock Guardrails in Terraform, why IAM still does the heavy lifting, and the failure modes nobody demos on stage.
Agents on Call, Part 7. Sizing: Token Math Nobody Does Upfront
The sizing math nobody does upfront: tokens per incident, quota ceilings, when provisioned throughput breaks even, and the platform's monthly bill.
Agents on Call, Part 8. Production: Observability, Evals, and the Day It Lies
OTEL traces into CloudWatch, Bedrock invocation logging to S3, an eval harness with a golden incident set, and the day the triage agent lied with confidence.