AI agent development on AWS Bedrock, in your own account and region.
An AI agent on AWS Bedrock is an autonomous system whose model calls go from your own AWS account to Amazon Bedrock, in the region you choose, rather than through a vendor's servers. Aldenebai, run by Paul Rahme, builds agents this way for companies with an AWS footprint or a data-residency requirement. The reference is the AI support agent at a US marina-software company, which runs on Bedrock with Claude and resolves about 60% of tickets with no human touch, rounded from production data, 2025–2026.
Why the model call runs in your AWS account, not the vendor's
Three things follow from it. The prompts and outputs are not used to train the models, under AWS's Bedrock data-protection terms. The access is governed by your own IAM policies, so who and what can invoke a model is decided by your security team, not by a vendor contract. And the usage appears on your own bill, so a monthly ceiling is a budget alert you already know how to set, not a licence negotiation.
Aldenebai holds no keys. During a build, access is through roles you grant and revoke at handover; the agent, its prompts, its logs, and its audit trail all live in your account.
What the Bedrock setup looks like: IAM, regions, logging, the audit trail
A dedicated IAM role for the agent with invoke permissions on the specific models it uses and nothing else, per Bedrock's IAM model. A region chosen for data residency. Model invocation logging switched on, so every prompt and response is kept in your own storage. On top of that, the agent's own audit trail: every read, decision, and action, with the reason, keyed to the ticket or record it touched.
Personal data can be redacted before a call where you require it, and the confidence threshold, allowed-action list, and kill switch are the same as on every Aldenebai system, described in the human-in-the-loop guide.
The AI support agent at a US marina-software company
Built by Paul Rahme and running in production, 2025–2026. The wiring into a helpdesk is written out step by step in the Zendesk on Bedrock guide.
When Bedrock is the wrong choice, and what to use instead
If you have no AWS footprint and no data-residency requirement, running a model through your own account on another cloud, or directly with a provider under their business terms, is simpler and the agent design does not change. If a specific model you need is not available on Bedrock in your region, the same allowed-action list and threshold wrap a different endpoint. Bedrock is a good answer to "where does our data go"; it is not a requirement for a good agent.
What an engagement looks like
The free Automation Audit maps the job first, because the choice of cloud is downstream of what the agent must do. Then a fixed-scope, fixed-price build in your account: the IAM role, the logging, the agent, its tests, and its runbook. A pilot on a slice of real traffic with a target named before it starts, then handover or an operate option with a named response time. How pricing works →
Questions about AI agents on Bedrock
Does our data leave AWS, or get used for training?
No. Model calls go from your account to Amazon Bedrock in the region you choose, under your own IAM permissions, and AWS documents that Bedrock does not store prompts or completions or use them to train models. Invocation logs stay in your storage, and the agent's audit trail is written to your systems. Aldenebai never holds keys; access during a build is through roles you grant and revoke at handover.
Which models can the agent use?
Whatever Bedrock offers in your region, with Claude as the model the production reference runs on. The agent is built so the model is a component behind a fixed interface, so changing it is a configuration decision reviewed like any other change.
What does it cost to run?
Model usage at Bedrock's rates on your own bill, plus the small compute the orchestration needs, with a monthly ceiling set as a budget alert in your account. There is no licence to Aldenebai. The build is a fixed price agreed before it starts.
Can this work with our existing helpdesk and tools?
Yes. The agent connects through the APIs of the tools you already run; the Zendesk wiring is documented step by step, and Freshdesk, Intercom, HubSpot Service Hub, and Jira Service Management expose the same operations. Bedrock is where the model runs; your tools stay where they are.
Related pages
Your account. Your data. Our build.
The free Automation Audit maps the job first and names honestly whether Bedrock is the right place to run it. 30 minutes, written Automation Map within 48 hours.