AWSAWS Certified Generative AI Developer - Professional2026-102.1 Implement agentic AI solutions and tool integrations
Enforce limits outside the agent prompt
Completed by the knowledge check
Learning objective
Constrain agent execution with budgets, timeouts, circuit breakers, and IAM resource boundaries
Core idea
For an architect operating an agent, execution safety requires several independent limits. A budget answers how much work remains. A timeout answers how long you wait. A circuit breaker answers whether a dependency should receive another attempt. An IAM resource boundary answers which AWS actions and resources the execution can access.
Apply these controls before dispatch, using trusted application state. A model may ask for extra work, but it cannot grant itself more money, a longer deadline, or permission to another tenant’s records. The workflow that hosts the agent and the functions that execute its tools enforce those decisions.
A single maximum-step setting cannot replace this envelope. One permitted step can contain an expensive model call or an unauthorized write. Conversely, an authorized call can remain within its IAM permissions while exhausting the execution’s time or spending allowance. The controls complement one another because each constrains a different failure mode.
How it works
Reserve budgets before concurrent work
Define an application-owned ledger for model attempts, tool attempts, remaining time, and estimated spending. Include retries, delegated calls, and failed attempts. These are workload policies rather than a claim that AWS provides one universal agent-budget parameter.
Amazon Bedrock Converse returns usage.inputTokens, usage.outputTokens, and usage.totalTokens. Use those fields to reconcile observed token use after a successful response. Set inferenceConfig.maxTokens to bound generated response tokens for an individual call. It does not cap input tokens or the total usage of an agent execution. Token preparation is covered in 1.3.9, and model benchmarking belongs to 1.2.2.
Post-call accounting alone cannot enforce a strict pre-call spending limit. Concurrent branches may all observe the same remaining allowance. Reserve a conservative allowance before dispatch and reconcile afterwards. If a request fails without usage evidence, keep its consumption unresolved until your accounting policy can settle it; do not assume that a missing response proves zero work.
For a shared ledger, DynamoDB UpdateItem provides ConditionExpression and UpdateExpression. A conditional update can require sufficient remaining allowance and subtract the reservation in the same item update. ConditionalCheckFailedException means the admission condition failed. Route that failure to the budget-exhausted outcome instead of automatically retrying until the agent gets admitted.
Scope the ledger key to a trusted execution and tenant identity. An agent-provided execution identifier must not select another execution’s allowance. With multiple budget dimensions, define which reservations must succeed together; one successful item update does not make an arbitrary series of updates transactional.
Nest deadlines and classify retries
Set TimeoutSeconds on a Step Functions Task to bound its active duration. For JSONPath workflows, TimeoutSecondsPath reads a positive integer from trusted state; a task cannot specify both fields. Reserve time for validation and cleanup rather than spending the entire user-facing deadline on inference.
For synchronous Lambda tool executors, the function’s Timeout defaults to 3 seconds and accepts 1–900 seconds (15 minutes); set it no longer than the calling task’s deadline minus cleanup time. For AgentCore Runtime LifecycleConfiguration limits, see 2.1.1.
The Step Functions HTTP task has a maximum timeout of 60 seconds even if TimeoutSeconds is larger. That limit is specific to the HTTP task; do not apply it to every integration. Choose the integration and task deadline from the work’s actual operating envelope.
Bound transient recovery through Retry.ErrorEquals, MaxAttempts, IntervalSeconds, and BackoffRate. MaxDelaySeconds caps retry delay, and JitterStrategy: FULL spreads retries over randomized intervals. MaxAttempts counts retry attempts, so the initial call also consumes your application budget. Repeated loop entries need the same shared admission check. Automatic task retries must also reserve allowance: put the conditional ledger update inside the calling Lambda before each external attempt, or replace that recovery path with an explicit workflow transition through admission.
A Catch route handles eligible task failures after retries are exhausted or absent. It cannot turn uncertain side effects into confirmed failures. A States.Timeout outcome means the workflow’s wait expired; resolve the tool’s operation identifier before replaying a write. The detailed bounded failover policy is in 1.2.5.
Keep circuit-breaker state outside the conversation
A circuit breaker is an application decision to stop calling a dependency after a defined failure pattern. Implement its state in a trusted store, such as a DynamoDB item updated with ConditionExpression, and expose the decision to a Step Functions Choice. Do not describe Retry as a managed circuit breaker: retry delay and shared dependency admission solve different problems.
Define closed, open, and half-open behavior. Closed permits calls. Open rejects or routes calls until a recorded probe time. Half-open permits a bounded probe; concurrent workers must not all become probes. A conditional update can claim that probe slot, then record success or reopen the circuit.
Classify failures before updating the breaker. Dependency unavailability can justify opening it; an invalid argument or denied authorization should terminate or request corrected input. Isolate breaker keys by the failure boundary, such as tool endpoint or model route. A bad request for one operation must not disable unrelated healthy tools.
Restrict the identities that execute actions
Use the IAM identity-based policy’s Action and Resource elements to scope tool executors and model callers to their permitted operations and resources. For Bedrock Converse, inference authorization uses bedrock:InvokeModel; do not invent a bedrock:Converse permission. The allowed model resources must match the selected invocation path.
An IAM permissions boundary limits what an identity-based policy can grant; it does not grant permissions itself. For identity-based permissions, the effective allowance is the intersection of the policy and boundary, and an explicit deny overrides an allow. Resource-based grants complicate that calculation: same-account grants directly to role sessions are not constrained by an implicit deny in a permissions boundary. Review resource policies as well as attached policies.
Keep business authorization in the tool boundary. IAM permission to access a table does not establish that a particular caller owns a particular record. Bind tenant and resource decisions to authenticated context, not to the model’s argument text. See 2.1.3 for state isolation.
Key distinctions and trade-offs
The controls have separate jobs:
| Control | Admission question | Main trade-off |
|---|---|---|
| Shared budget reservation | Can this execution afford the attempt? | Conservative reservation can reject useful work |
| Task timeout | Can this work finish within the wait? | Short waits increase uncertain outcomes |
| Circuit breaker | Should this dependency receive another call? | A broad breaker can block healthy operations |
| IAM policy and boundary | Can this identity perform this AWS operation? | Resource scoping requires matching the invocation path |
Architecture / decision scenario
A procurement agent compares suppliers and prepares purchase requests. Two specialist branches share one spending ledger. Each branch reserves allowance through conditional UpdateItem before inference and caps response length with inferenceConfig.maxTokens. A failed reservation ends that branch with an explicit budget outcome.
Supplier lookup tasks have deadlines shorter than the overall response target. Repeated availability failures open the lookup circuit; one half-open probe can claim recovery. The agent cannot bypass that state by asking a different specialist to call the same failing endpoint.
The planning identity can invoke approved models and read approved resources. A separate action executor has narrowly scoped write permissions and checks the authenticated tenant and approved purchase request. A timeout in that executor triggers reconciliation, not a second purchase. This design exercises all four limits without treating any one as a substitute for the others.
Common exam traps
- Treating
maxTokensas a total execution or spending cap. - Using post-call token accounting as pre-call admission for concurrent branches.
- Counting
MaxAttemptswhile forgetting the initial invocation. - Treating retry backoff as shared circuit-breaker state.
- Assuming a permissions boundary grants access or limits every resource-based grant.
- Reading a timed-out write as proof that nothing changed.
What to remember
- Reserve shared allowance before dispatch and reconcile observed usage afterwards.
- Budgets include retries and delegation.
- Timeouts limit waiting; breakers limit dependency admission.
- IAM constrains AWS access, while tools enforce caller-specific business rules.
- Keep every limit in trusted state outside model-generated arguments.
Knowledge check
Two specialist branches of one agent execution share a spending allowance. Both read the remaining allowance, both see enough, and both dispatch expensive Converse calls, overspending the limit. Usage is recorded from usage.totalTokens after each response. Which change enforces the limit?
inferenceConfig.maxTokens on every call each branch makesUpdateItem before each call, then reconcileusage.totalTokens sooner, as soon as each response arrivesmaxTokens caps one call’s output, not input tokens or the execution’s total.A dozen agent executions call the same supplier-lookup endpoint, which is down. Each Task has Retry with backoff and jitter, yet the endpoint keeps receiving a steady stream of calls. Which control stops the traffic until the endpoint recovers?
BackoffRate and MaxDelaySeconds on every retrierA Step Functions Task has TimeoutSeconds: 60 and invokes a Lambda tool executor whose Timeout is 300 seconds. When the Task times out, the function can still be writing, and no time is left for validation. What fixes the arrangement?
Timeout below the Task deadline minus cleanup timeTask ’s TimeoutSeconds to 300 to match the functionRetry on States.Timeout so the Task tries the call againA planning role’s permissions boundary allows bedrock:InvokeModel on the approved model. Its identity-based policy grants only S3 actions, and its Converse calls are denied. Which change authorizes inference?
bedrock:Converse on the approved model to the identity-based policybedrock:InvokeModelbedrock:InvokeModel on the approved model to the identity-based policybedrock:* on all resourcesConverse is authorized by bedrock:InvokeModel ; there is no bedrock:Converse action, and widening the boundary grants nothing either.