01 / Principal and identity
Who acts, and what can the platform identify?
A Bedrock agent selects an action group; its Lambda executor invokes a business system.
The action-group invocation includes the selected operation and parameters; application identity must be supplied and validated by the deployment.
- 01Originating task
- 02Agent or workload
- 03A refund action group issues a credit.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Validate operation, caller and arguments in Lambda and again at the refund service.
Bind order, customer, amount and refund policy to the task.
Delegation constraint
A model-selected action does not inherit unlimited permission from the Lambda role.
03 / Worked denial
Test a request outside the grant.
A support task allows a $40 credit but the proposed refund is $400.
Adversarial verification
Send an action-group Lambda event with a refund amount above the order cap. Confirm Lambda rejects the operation before calling the refund service, even if its execution role has API access.
04 / Review and responsibility
What should the audit trail prove?
Agent invocation, action group, operation, parameters, decision, Lambda attempt and refund state.
IAM controls service invocation; business authority still belongs at the effect boundary.
Platform primary source