AWS Stacks the Deck for AI Agent Security: MicroVMs, Policy Enforcement, and the Sovereignty Question

The gap between AI agent demo and AI agent in production has always been governance. AWS just closed a significant portion of that gap with three interlocking capabilities: Lambda MicroVMs for isolated code execution, Policy in Amazon Bedrock AgentCore for deterministic access control, and SageMaker HyperPod data capture for inference observability. That timing isn’t an accident. As the EU AI Act’s high-risk system obligations approach (now pushed to December 2027 for Annex III systems, though Article 50 transparency requirements remain on the original August 2, 2026 schedule), enterprises need infrastructure that can prove what their agents did, why, and within what boundaries.

In Brief

AWS has released a three-layer security stack for AI agents: Lambda MicroVMs provide Firecracker-based VM isolation for agent-generated code, Policy in AgentCore enforces Cedar-based authorization at the gateway level, and SageMaker HyperPod now captures inference payloads at three tiers for audit and model improvement. Together, these address the core production blockers for autonomous AI systems: isolation, governance, and observability.

For Bulgarian teams building agentic applications, this stack offers a path from proof-of-concept to production without building custom security infrastructure, though the sovereignty question remains open for workloads subject to EU data residency requirements.

If your team is wrestling with agent governance in production, these patterns will be on the agenda at ISTA 2026 this September. The organisers are looking for practitioners who have actually shipped this stuff.

Pattern Name: Secure AI Agent Execution Stack

Why This Is Important: Adoptable. The three components (MicroVMs, AgentCore Policy, HyperPod data capture) are now generally available in multiple regions, with production case studies emerging. Teams can pilot today without waiting for standards to mature.

Domain: DevOps, Security, AI

Who Should Care: DevOps/SRE, Backend, Security, Manager

Level: Intermediate

Evidence Type: Release, Case Study

The Problem

AI agents generate and execute code at runtime. A developer normally writes and reviews every line before it ships; an agent produces code on the fly, based on a prompt and whatever context it’s been given. That’s the core problem: there’s no way to review or vet the code before it runs.

The threat model shifts from protect against bugs to protect against arbitrary adversarial code. Key attack vectors include:

• Container escape via kernel exploits
• Credential leakage from environment variables and SSH keys
• Network exfiltration to attacker-controlled endpoints
• Resource exhaustion through fork bombs or memory attacks
• Privilege escalation through misconfigured mount points

Standard containers share the host kernel. A single malicious prompt could produce code that exploits kernel vulnerabilities to break out of its container, access credentials stored in memory, or exfiltrate data from adjacent workloads. The NVIDIA AI red team reports that executing LLM-generated code without proper isolation can lead to remote code execution. Traditional code sanitization does not work for AI agents because malicious and legitimate code often look identical.

Isolation on its own doesn’t solve the problem, though. An agent that can send emails, query databases, execute code, or trigger financial transactions needs clear limits on what it’s allowed to do, not just where it runs. The same qualities that make agents useful, open-ended reasoning, flexible tool use, adaptability, are exactly what makes their behavior hard to predict and harder to control than a traditional program.

What Changed

AWS released three separate capabilities, one for each layer of the problem:

Lambda MicroVMs

Lambda MicroVMs (GA June 22, 2026) provide Firecracker-based VM isolation with near-instant launch, state preservation for up to eight hours, and dedicated HTTPS endpoints per session. Each MicroVM runs its own Linux kernel, making container escape meaningless.

The service supports suspend/resume with memory and disk state intact, so an agent session can pause when idle and resume with installed packages, loaded models, and working filesets preserved. AWS documentation confirms availability in US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland).

Policy in Amazon Bedrock AgentCore

Policy in Amazon Bedrock AgentCore (GA March 3, 2026) provides deterministic authorization for agent-to-tool interactions. Policies are authored in natural language, automatically converted to Cedar (AWS’s open-source policy language), and enforced at the AgentCore Gateway.

Every agent action flows through the gateway, gets evaluated against policies, and produces an allow or deny decision recorded in the audit log. The system supports fine-grained permissions based on user identity and tool input parameters.

SageMaker HyperPod Data Capture

SageMaker HyperPod data capture (GA May 20, 2026) records inference request and response payloads at three tiers: the SageMaker endpoint, the Application Load Balancer, and the model pod itself. AWS documentation notes that captured data is delivered asynchronously to S3 without blocking inference, supports configurable sampling, and enables customer-managed KMS encryption.

Why Now

There’s real regulatory pressure behind this too. The EU AI Act’s Article 50 transparency obligations take effect August 2, 2026, requiring disclosure of AI interactions. While the Digital Omnibus package pushed the Annex III high-risk deadline to December 2, 2027, the underlying obligations have not changed: risk management, technical documentation, human oversight, and post-market monitoring. Organizations need infrastructure that can demonstrate compliance, not just claim it.

The sovereign cloud market is projected to reach $139.27 billion in 2026, growing at 18.70% CAGR through 2035. American hyperscalers hold approximately 70% of the EU cloud market, creating tension with GDPR Article 48 requirements and the US CLOUD Act’s extraterritorial data access provisions.

The Cloud Security Alliance notes that the European Commission’s June 2026 European Technological Sovereignty Package creates a formal four-level sovereignty assurance framework governing which cloud services may handle sensitive public-sector workloads.

The underlying tech has caught up too. Firecracker MicroVMs achieve 100-125ms cold starts, compared to several seconds for traditional serverless platforms without optimization. Cedar policies provide formal verification through automated reasoning that checks for overly permissive, overly restrictive, or unsatisfiable conditions before enforcement. The Agent Toolkit for AWS now includes 40+ validated skills across infrastructure-as-code, storage, analytics, serverless, containers, and AI services.

The New Practice

These three layers only work as a set. Skip the expertise layer and agents running safely in isolation still ship code that breaks in production. Skip governance and a well-guided agent can still wander outside its lane. Skip execution isolation and governance policies become a paper wall, easy to route around at runtime.

Layer 1: Execution (Lambda MicroVMs)

Create a MicroVM image from a Dockerfile, upload it to S3, and Lambda runs the Dockerfile, initializes the application, and snapshots the running memory and disk state. Every subsequent MicroVM launched from that image resumes from the pre-initialized snapshot rather than booting cold. Call run-microvm, pass the image ARN and an idle policy, and the service returns a dedicated HTTPS endpoint with the application already running.

The execution model differs from Lambda Functions. The practical unit is a session, not an invocation. Lambda can vertically scale a running MicroVM above its configured baseline (up to 16 vCPUs, 32 GB memory, 32 GB disk), but it does not automatically create a fleet of MicroVMs behind one shared endpoint. Teams that need horizontal scaling must build that orchestration layer.

Layer 2: Expertise (Agent Toolkit for AWS)

Agent skills are packaged domain expertise: architecture decision tables, service comparison matrices, deployment workflows, and troubleshooting guides. The Lambda plus API Gateway skill, for example, includes the AddPermission step that grants API Gateway permission to invoke the function, the step agents most consistently miss without guidance.

The AWS MCP Server provides real-time documentation search (no AWS credentials needed for searching docs) and authenticated AWS API calls using IAM credentials. Calls go through the managed server, get validated, and land in CloudTrail. IAM condition keys allow policies specific to agent-initiated actions, enabling read-only access through the MCP server even if the developer’s own role can write.

Layer 3: Governance (Policy in AgentCore)

Policies define what actions an agent is allowed to perform, which tools it can call, and the precise conditions under which those actions are permitted. The AgentCore Gateway intercepts every tool call, evaluates it against policies, and produces a deterministic allow or deny decision.

Lambda interceptors complement policies for dynamic validation. A policy might say agents can only access customer data during business hours. An interceptor might validate that the customer ID in the request matches the authenticated user’s scope. The combination handles both static rules and runtime context.

Tooling Implications

For existing Lambda users: MicroVMs are a separate resource from Lambda Functions, with their own API surface. They target workloads Functions was never designed for: long-running, stateful, multi-tenant applications that execute code the developer did not write. Short, stateless, event-driven work should stay on Functions.

For Kubernetes teams: SageMaker HyperPod data capture requires the EKS orchestrator. The feature is available in all AWS Regions where HyperPod is supported. Teams using self-managed Kubernetes clusters will need to build equivalent capture pipelines.

For multi-cloud deployments: AgentCore Policy uses Cedar, which is open source and powers AWS Verified Access and Amazon Verified Permissions. The policy language is portable, but the enforcement gateway is AWS-specific. Teams with multi-cloud requirements will need equivalent enforcement points in other environments.

For sovereignty-constrained workloads: Lambda MicroVMs launched in Europe (Ireland) only. Teams with strict EU data residency requirements should verify that inference, storage, and policy enforcement all occur within acceptable jurisdictions. The distinction between storage residency and inference residency matters: a vendor can store files in Europe but process prompts elsewhere.

Evidence

The AWS Compute Blog provides a reference architecture combining all three layers for a serverless development agent. The agent generates code, installs dependencies, runs tests, and deploys infrastructure within a MicroVM boundary, guided by Agent Toolkit skills, and governed by AgentCore policies.

Sage uses AgentCore to build a federated AI agent marketplace

that enables non-technical users to self-serve data access through domain-specific agents for customer preparation, product analytics, and real-time insights. The deployment uses multi-tier pipelines balancing innovation with enterprise security.

The InfoQ analysis notes that MicroVMs eliminate the three-way tradeoff between strong isolation, fast launch times, and state retention that previously forced teams to choose between VMs, containers, and functions.

Failure Modes

Isolation is not a complete security model. VM-level isolation improves the execution boundary. Teams still own identity, permissions, egress, tool authorization, logging, and state cleanup. A MicroVM that can make arbitrary network calls to attacker-controlled endpoints is still a risk, regardless of kernel isolation.

Policy bypass through prompt manipulation. Policies operate outside agent code, but agents can still be manipulated through prompts to attempt unauthorized actions. The policy layer will deny those actions, but the attempt itself may reveal information about system boundaries. Logging and alerting on policy denials is essential.

Cold start latency for complex images. MicroVMs resume from snapshots, but the initial image build and snapshot creation can take minutes for complex environments. Teams should pre-build images for common agent configurations rather than building on demand.

Data capture volume and cost. Capturing 100% of inference payloads at three tiers generates significant S3 storage costs. Configurable sampling helps, but teams should model expected capture volume before enabling full capture in production.

Metrics to Watch

Track policy evaluation latency (target: sub-10ms for 99th percentile). Monitor MicroVM cold start times for your specific images. Measure the ratio of policy denials to total requests as an indicator of agent behavior drift. Track data capture S3 costs as a percentage of total inference costs.

For compliance, maintain audit trails showing which policies were in effect at the time of each agent action, which user identity was associated with each request, and which tools were invoked with what parameters.

Do This Next Sprint

1. Inventory your agent workloads. Identify which agents execute code, which access sensitive data, and which make decisions that require audit trails.

2. Pilot Lambda MicroVMs for one code-executing agent. Start with a development or staging environment. Measure cold start latency for your specific image configuration.

3. Define three Cedar policies. Pick one agent and write policies for: (a) which tools it can call, (b) which data it can access, (c) under what conditions it can take actions. Use the natural language authoring to generate initial Cedar, then review the generated policies.

4. Enable HyperPod data capture at Tier 1 with 10% sampling. Verify that captured data flows to S3 correctly before increasing sampling or enabling additional tiers.

5. Review your sovereignty requirements. If your workloads are subject to EU data residency requirements, verify that all three layers (execution, governance, observability) operate within acceptable jurisdictions.

What This Means for Bulgaria

Bulgarian teams building AI agents for EU customers face the same sovereignty questions as everyone else, but with additional considerations. The Lambda MicroVMs Europe (Ireland) region is the closest available, but Irish data residency may not satisfy all EU data localization requirements, particularly for public sector or financial services workloads.

Practical actions:

Ask your compliance lead whether Article 50 transparency obligations apply to your AI systems before August 2, 2026. The Digital Omnibus pushed Annex III high-risk deadlines to December 2027, but transparency requirements remain on the original schedule.

If you are building agents that will process Bulgarian citizen data, verify whether your cloud provider’s EU region satisfies GDPR Article 48 requirements. The distinction between data stored in EU and data processed under EU jurisdiction matters for US-headquartered providers subject to the CLOUD Act.

For teams interviewing at ISTA ecosystem companies (Experian, SAP, Accenture, Avenga), ask about their agent governance strategy. Companies that have already deployed AgentCore Policy or equivalent controls are further along the maturity curve than those still relying on prompt engineering for safety.

Bulgarian startups building agentic products for EU markets should consider whether sovereign cloud providers (OVHcloud, IONOS, Scaleway) offer equivalent isolation and governance capabilities. The hyperscaler stack is more mature, but sovereignty requirements may force architectural compromises.

Dig Deeper

• Secure code execution for AI agents with AWS Lambda MicroVMs (AWS Compute Blog, July 2026)
• Secure AI agents with Policy in Amazon Bedrock AgentCore (AWS Machine Learning Blog, March 2026)
• How to sandbox AI agents in 2026: MicroVMs, gVisor & isolation strategies (Northflank, February 2026)
• EU AI Act High-Risk Deadline Pushed to December 2027 (Cloud Security Alliance, July 2026)
• Agent Toolkit for AWS (AWS documentation)