Ambient Agents on AWS: Event-Driven Triggers, SQS Routing, and the ask_human Tool

Amazon has introduced a new type of agent called ambient agents on AWS. Unlike traditional chat-based agents that run inside a request-response cycle, ambient agents are triggered by various events such as S3 uploads, cron schedules, or alerts. This shift in control flow requires different orchestration plumbing, including message routing, state persistence across pauses, and a clear boundary for human approval.

To handle these needs, Amazon Bedrock AgentCore now supports ambient agents. The architecture uses Amazon Simple Queue Service (SQS) for event ingestion, AWS Lambda for execution, Amazon DynamoDB for state management, and a single tool called "ask_human" to pause the agent until a human reviews the decision.

Key components of this system include:

1. Event sources: S3 bucket notifications, EventBridge schedules, CloudWatch alarms, or SNS topics.

2. SQS queue: All events land in this queue, decoupling event producers from agent execution.

3. Lambda function: Polls SQS, invokes the Bedrock AgentCore runtime, executes tools, and writes state to DynamoDB.

4. Jobs page (a web UI): Humans review pending decisions and approve or reject tool calls.

5. ask_human tool: This is the only tool that pauses execution. When called, it returns a special status code, and the Lambda function serializes the agent's state, writes it to DynamoDB, and exits.

The ask_human tool's role is crucial in pausing the agent's execution. When the agent calls this tool, it indicates that a human approval is required. The Lambda function captures this, saves the agent's state (including the reasoning chain, pending decision, and execution ID) to DynamoDB, and then exits. A notification is sent to the Jobs page, where a human can review the pending decision and either approve or reject it.

Upon receiving a human's approval, another SQS message is triggered, which reloads the agent's state from DynamoDB and resumes the agent's execution. If the human rejects the decision, the Jobs page records this rejection, and the Lambda function continues with the agent's next steps, which may include retrying with a modified plan, escalating to a different human, or aborting the workflow and logging the failure.

To prevent infinite loops, event-driven agents must include safeguards. For example, S3 notifications can be configured to filter by prefixes or suffixes, ensuring that the same agent does not trigger itself repeatedly. Additionally, storing a depth counter in DynamoDB can limit the execution depth, preventing endless loops.