Implementation and Integration

Decision frame

A production GenAI application is a distributed system with a probabilistic component. Keep deterministic concerns—identity, authorization, schemas, transactions, quotas, retries, state transitions, approvals, and audit—outside the model. Give the model only the context and tools required for the current task, then validate every boundary crossing.

Choose a deterministic workflow when the sequence and rules are known. Choose an agent only when planning among bounded alternatives materially improves the task. Increased autonomy expands the failure surface and must be matched by stronger tool controls, budgets, stop conditions, observation, and human oversight.

Objective map

Objective	Required judgment	Proof
2.1 Implement agents and tools	Bound goals, schemas, identities, memory, tools, approvals, retries, and termination	Unauthorized or malformed tool requests are denied and every action is traceable
2.2 Deploy GenAI applications	Package model-dependent inputs, isolate environments, gate releases, scale, and roll back	A failed candidate returns to the exact prior configuration
2.3 Integrate enterprise systems	Connect identity, APIs, events, data, records, and workflows with least privilege and failure isolation	Integration failures do not corrupt records or widen access
2.4 Use foundation model APIs	Handle authentication, invocation, streaming, limits, structured output, errors, quotas, and retries	The client degrades safely under malformed output, throttling, and provider failure
2.5 Apply application patterns and development tools	Select sync, async, event, workflow, batch, cache, and developer patterns from constraints	The pattern meets latency and reliability goals without hidden coupling

Foundation model API integration

Use a supported Amazon Bedrock runtime API and understand the abstraction chosen. A common conversation interface can reduce model-specific client logic, while model-native request formats may expose different capabilities. Record the exact model identifier or inference profile, Region, API, prompt template, parameters, guardrails, and output parser as release configuration.

Design the client for token and output limits. Validate input size before invocation. Reserve space for expected output. Treat truncation, refusal, malformed structured output, throttling, access denial, model unavailability, timeout, and safety intervention as explicit states. Streaming improves perceived latency but exposes partial output; buffer or moderate where the application must not display incomplete unsafe content. Never retry a mutating business action merely because the model response timed out.

Retries need bounded exponential backoff, jitter, deadlines, and idempotency where the surrounding operation supports it. A retry storm can exhaust quotas and increase cost. Queue or shed noncritical work, route to an approved fallback, or return a clear unavailable state. Do not silently switch to a model that changes data residency, quality, safety, or contractual properties.

Agents and tool boundaries

Define the agent's allowed goal and prohibited outcomes. Each tool needs a narrow name, description, strict input and output schema, scoped execution identity, timeout, size limit, error model, idempotency behavior, and audit event. Authorize the requested action in deterministic code using the authenticated user and current resource—not the model's claim about who the user is.

Separate read-only tools from mutating tools. Require human approval for irreversible, high-impact, financially material, externally visible, or ambiguous actions. Approval should show the exact proposed action, target, relevant evidence, and consequences. Revalidate authorization and state after approval because the world may have changed.

Treat tool output as untrusted content. A retrieved webpage, ticket, database field, or email can contain indirect prompt injection. Delimit it, validate schema and provenance, limit size, and prevent it from altering system instructions or tool permissions. Constrain loops with maximum steps, time, token, and cost budgets. Record plan, tool request, authorization decision, result, retry, denial, and final status without exposing secrets.

Memory is a data store, not intuition. Define which facts may persist, who owns them, retention, tenant partitioning, correction, deletion, and whether the model may treat them as authoritative. Conversation history can leak data or exceed context limits; summarize only with validation appropriate to the use case.

Enterprise integration patterns

Use API Gateway, Lambda, Step Functions, EventBridge, queues, streams, containers, and managed data services according to workload needs rather than adding every service. A synchronous request fits short interactive tasks with bounded latency. Asynchronous queues fit long or bursty work and enable backpressure. Step Functions fits known orchestration with explicit state, retries, branching, and approval. EventBridge fits routed business or service events. Batch fits large offline evaluation or enrichment where interactive latency is irrelevant.

Preserve transaction boundaries. If generated content updates a system of record, validate the output, authorize the user, check current state, use idempotency, and record the authoritative transaction result. The model should propose; deterministic application logic should commit. Use correlation IDs across retrieval, model, tool, and business events.

Deployment and release design

Package application code, prompt versions, model IDs, inference parameters, tool schemas, retrieval configuration, guardrails, and evaluation thresholds. Keep environment-specific secrets and resource identifiers outside the artifact. Use infrastructure as code and separate build from deployment identities. Run unit, integration, security, evaluation, and smoke checks in an isolated environment.

Deploy progressively when impact warrants it. Compare candidate and baseline on quality, safety, latency, errors, and cost. Keep a rollback image and all configuration required to restore behavior. A model alias or prompt edit made outside the release process can invalidate reproducibility. Rollback triggers should include hard safety failures and business correctness, not only HTTP health.

Decision patterns

Situation	Prefer	Required control
Known multi-step business process	Step Functions or equivalent deterministic workflow	Explicit states, retries, compensation, and audit
Ambiguous planning across safe tools	Bounded agent	Tool allowlist, scoped identities, budgets, and observation
Irreversible action	Human approval plus deterministic execution	Show exact target and recheck authorization/state
Bursty long-running inference	Queue-backed asynchronous workers	Backpressure, idempotency, dead-letter handling
Interactive generation	Synchronous or streaming call	Deadline, partial-output policy, and safe failure
Release model or prompt change	Versioned deployment with evaluation gate	Exact rollback configuration

Scenario drill

A support agent reads tickets, searches approved knowledge, drafts replies, and may issue refunds up to a policy limit.

Use authenticated user context and separate read, draft, and refund tools.
Restrict ticket and knowledge retrieval to the user's tenant and role before content reaches the model.
Define refund input schema, amount limits, idempotency key, current-order check, and scoped service identity.
Require approval for refunds or external replies according to policy.
Treat ticket text and knowledge documents as untrusted data that cannot change tool permissions.
Record each tool request, authorization decision, approval, and authoritative result.
Test duplicate requests, stale order state, malformed tool output, prompt injection, throttling, and rollback.

Common traps

Using an agent for a known sequence that a workflow could enforce deterministically.
Giving every tool the same broad execution role.
Treating tool schemas as authorization controls.
Retrying non-idempotent mutations after an ambiguous timeout.
Allowing retrieved content to redefine the agent's instructions.
Deploying a prompt or model change outside the versioned release artifact.
Checking only availability during canary rollout and ignoring quality or safety regression.

Self-check

Decide whether a sample task needs a workflow or an agent and defend the operational tradeoff.
Define a secure tool contract for one mutating action.
Explain how streaming changes output validation.
Design idempotency and failure handling for a queued inference task.
List everything required to reproduce and roll back a GenAI release.

Objective coverage

Implement agents and tools

Deploy GenAI applications

Integrate enterprise systems

Use foundation model APIs

Apply application patterns and development tools