Serverless and AI on AWS in 2026: Governing Agents and the New Agent Economy

In part one we covered how AWS gave AI agents hands and memory: Lambda MicroVMs and Durable Functions for stateful, long-running compute, and S3 Vectors, Annotations, and managed Knowledge Bases for retrieval. That answered two of the three broken assumptions of classic serverless, stateless and short-lived. The third one, trusted code, is not a compute problem. It is a governance problem. Building an agent is easy. Running one your compliance team will sign off on is not. This post covers that layer, the framework you write agents in, the tooling that generates all of it, and the economic twist waiting at the edge.

Governance: Agents Grow Up

Amazon Bedrock AgentCore: who keeps agents under control in production?

Amazon Bedrock AgentCore is easier to understand if you group it by the three questions an enterprise actually asks before letting an agent touch production, rather than by its component list.

“What is it allowed to do?” This is AgentCore Policy. You express boundaries in natural language, backed by Cedar, enforced at the AgentCore Gateway on every single tool call. A rule like “auto-approve refunds up to $100, require a human above that” becomes an enforced policy, not a code comment someone forgets. Bedrock Guardrails plug in alongside it to check agent actions for prompt injection, harmful content, and sensitive-data exposure.

“What did it actually do?” This is Observability plus AgentCore Evaluations. You get 13 pre-built evaluators for qualities like correctness, helpfulness, and safety, and they run continuously against real interactions rather than only in a test suite. Recommendations and A/B testing are now GA. Episodic Memory carries context across sessions, so an agent that helped a customer last week does not start from zero this week, and you can audit what it remembered.

“How fast can I ship one?” This is AgentCore Harness, GA since June 2026. Two API calls, CreateHarness and InvokeHarness, and AWS wires up identity, memory, the tool gateway with enforced policies, organizational knowledge, managed Web Search, and observability for you. The Web Search piece is worth calling out: it returns current, cited web knowledge with zero data egress from your AWS environment, which is exactly the constraint that usually blocks agents from touching the open web at regulated companies.

There is real overlap between AgentCore Runtime and the Lambda MicroVMs from part one. Both give you isolated sessions of up to 8 hours. The difference is intent. MicroVMs are a general-purpose primitive with suspend and resume and full lifecycle control, so you decide the shape. AgentCore Runtime is opinionated, agent-shaped packaging that trades that control for a faster path to a hosted agent. Pick MicroVMs when you need control or when the workload is not strictly an agent. Pick AgentCore Runtime when you want AWS to make the hosting decisions for you and you are happy inside its model.

Strands Agents: which framework do I actually write the agent in?

AgentCore hosts any framework, LangGraph, CrewAI, LlamaIndex, the OpenAI Agents SDK, and others. Strands Agents is the open-source, code-first, model-driven SDK that AWS itself dogfoods. It works with AgentCore but is not locked to it, and it runs anywhere, including edge devices.

The 2026 additions are aimed at the parts of agent development that usually go untested. The Harness SDK gained improved context management. Strands Shell gives you an isolated execution environment. And Strands Evals adds chaos testing and red teaming, which is the interesting one. Chaos engineering for agents means deliberately feeding an agent malformed tool responses, injected instructions, and adversarial inputs to see where it breaks before a real user finds out. Testing the happy path of an agent is easy and mostly worthless. Testing what it does when a tool lies to it is the work.

The Meta Layer: AI Builds Serverless

The Agent Plugin for AWS Serverless: and who builds all of this?

Announced March 2026, the Agent Plugin for AWS Serverless packages skills, sub-agents, hooks, and MCP servers for AI coding assistants like Claude Code, Kiro, and Cursor. It covers Lambda and its event sources (EventBridge, Kinesis, Step Functions), SAM and CDK project setup with reusable constructs, observability best practices, durable-functions patterns, and API Gateway guidance. In Claude Code you install it with one command:

/plugin install aws-serverless@claude-plugins-official

There is a nice symmetry here. In the same stretch of months that AWS shipped the sandbox for AI-generated code, it shipped the tool that generates that code. The runtime for the agent and the developer that is the agent converged on the same platform at the same time.

Epilogue: The Agent Economy

Every section so far has been about you building agents. The last one flips the perspective. Agents are coming to you.

AWS WAF added an AI Traffic Monetization capability to Bot Control at Summit NY 2026. Content providers can price, meter, and collect payment from AI bots and agents that access their content and APIs. Payment runs through third-party providers, and scoped access is granted directly at the edge.

Think about what that implies. For two decades the deal was simple: bots either got blocked or crawled for free. WAF is proposing a third option, a turnstile. An agent that wants your data pays for a scoped, metered pass, and the transaction happens at the CDN edge before the request ever reaches your origin. The web is growing a cash register.

That is the arc of the 2026 serverless rebuild in one line. It started with giving agents hands and memory, moved through keeping them accountable, and ends with the web itself learning to charge them at the door. If part one was about the agents you build, this was about the world they are about to operate in.

If you want to go deeper on any single piece, two hands-on follow-ups are worth doing: a real MicroVMs sandbox for AI-generated code, and a head-to-head build of the same workflow in Lambda Durable Functions and Step Functions. Both are on my list.