[AWS Summit Seoul 2026] Controllable AI Agent Architecture in Regulated Environments

As generative AI evolves into AI agents that plan and use tools on their own, securing governance over data access permissions and behavior is essential in regulated industries such as finance and healthcare.

Regulation is not simply a constraint but a requirement for safe design. To this end, a Layered Compliance approach is recommended, in which privacy laws, industry-specific regulations, and standards such as NIST AI RMF or the AWS Well-Architected Framework are placed in layers on top of the application.

The architecture for building safe agents is divided into three perspectives.

• Build and Deploy: Security standards can be quickly met through Amazon Bedrock AgentCore, AWS's fully managed service, or infrastructure can be directly controlled through a self-managed approach based on Amazon EKS.
• Control: The area that controls the model's input and output and the area that controls the agent's actual behavior are managed separately in a dual structure.
• Maintain: A structure must be in place to continuously verify quality, security, and compliance standards even after deployment.