Three-Layer AI Guardrails on Bedrock AgentCore — How AgentFlo Hit +12% Revenue
Cloud Platform EngineeringA +12% net revenue uplift from AI sales agents sounds like a marketing claim. The Part 2 architecture post behind AgentFlo’s deployment explains why it isn’t — and reveals how the result comes from policy enforcement, not model quality.
What Happened
AgentFlo, covered here in Part 1, is the agentic commerce service from Salesflo that deploys AI sales agents across WhatsApp for merchants processing $300 billion in annual transacted value. The AWS Architecture Blog’s Part 2 post focuses on the production reliability architecture rather than the headline capability.
The measured results from 90 days of early deployment: +12% net revenue uplift, +40% customer engagement, +15% conversion rate, +8% average order value, and +20% customer reactivation. The post explains these numbers as outputs of three specific architectural decisions.
Why It Matters
Defense-in-depth guardrails are the core of the architecture. Rather than relying on the model to stay within business rules, AgentFlo implements three independent filtering layers. At the AWS Fargate boundary, prompt injection is detected and opt-out signals are handled before requests ever reach the agent. At the Amazon Bedrock AgentCore level, Cedar policies — AWS’s open-source verifiable authorization language — enforce business rules deterministically, independent of model reasoning. This separates “what the model decides” from “what business policy permits,” a distinction that matters when agents are handling cart commitments and pricing queries for real transactions. A third post-turn filter blocks inadvertent token disclosure and unverified price claims before responses reach customers.
Stateful session design prevents hallucination at the worst possible moment: when a customer asks about pricing or order status. AgentFlo uses a two-table DynamoDB design (Session Table and Cart Table) that loads the last 15 messages on each turn, giving agents full conversation context across multi-day purchase journeys. Product discovery uses vector embeddings in Amazon Aurora so natural language queries (“the pink one”, “the smallest one”) resolve to correct SKUs rather than approximations.
Observable cost attribution ties each conversation to revenue outcomes at the merchant level. Data Firehose pipelines all interactions to S3. Merchants can see per-agent, per-conversation cost breakdown against sales revenue — the foundation of the +12% revenue measurement.
The incoming server-side tool execution architecture (currently in development) is worth watching: replacing client-side orchestration loops with a single API call projects approximately 30% lower latency for focused tool sequences.
The So What
The revenue result is real because the reliability architecture is real. An agent that can confidently retrieve accurate pricing, maintain session state across days, and defer to Cedar policies for business rule enforcement is different from one that reasons about those constraints in every response. If you’re building production agents on Bedrock, the three-layer guardrail pattern and the DynamoDB session design are the most transferable pieces of this architecture — both directly applicable without needing the AgentFlo-specific commerce context.
Source: AWS Architecture Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →