Securing Amazon Quick from POC to production: Agents, Flows, and Spaces

AnyCompany, a company with five thousand employees spread across five departments and five locations, faced challenges when scaling their Amazon Quick proof of concept (POC) project to production. The security and compliance teams struggled to review the production plan, as the permission model that worked for ten pilot users broke when additional five departments were added.

To address this issue, the solution involved shaping one source dataset into three authorization-aligned views and connecting each to a purpose-built Agent. These views were then published to corresponding Dashboards, scoped Spaces, and gated outbound actions through a Flow with human-in-the-loop controls.

The source dataset was transformed into three datasets: anycompany-employees-full, anycompany-employees-manager, and anycompany-employees-trends, with sensitive columns removed and documents classified appropriately. The HR Leadership Dashboard provided full workforce visibility, including salary, attrition risk, and position-level breakdowns across all employees.

The Department Manager Dashboard presented operational metrics scoped to a single department through Row-Level Security, while the Company Trends Dashboard displayed aggregated department-by-location summaries, with no individual employee data accessible.

Four patterns were used to enforce security throughout data architecture: dataset shaping, agent isolation, document classification, and approval gates. These patterns removed sensitive data before it reached users, rather than relying on permission settings. A governance framework and production readiness checklist were also included in the walkthrough.