AWS modern data mesh architecture governs agentic AI with fine-grained access controls

AWS has shared a detailed architecture for building production-ready agentic AI applications that require governed access to multiple data sources across an organization. The post, “Building agentic AI applications with a modern data mesh strategy on AWS,” extends a previous secure RAG approach to address the unique governance challenges of autonomous AI agents. These agents need fine-grained access control at every layer – from tool discovery and schema inspection to SQL query execution and response synthesis – something the single-checkpoint model used for standard RAG cannot provide.

The architecture introduces three key upgrades. First, it replaces Amazon OpenSearch Serverless with Amazon S3 Vectors for knowledge bases, which can reduce vector storage and query costs by up to 90% for moderate query-frequency workloads. Second, it migrates from general-purpose S3 to S3 Tables with built-in Apache Iceberg support, governed by AWS Lake Formation for delivery of up to 10 times higher transactions per second and fine-grained row, column, and cell-level security. Third, it exposes the data mesh as Model Context Protocol (MCP) tools through AgentCore Gateway, with AWS Lambda-backed interceptors that enforce deterministic access control on every agent-to-tool invocation. The architecture also includes request/response interceptors for JWT validation, data redaction, audit logging, and Bedrock Guardrails to block prompt injection and sensitive data exposure in real time.