References

Sources behind Part 0's claims, grouped by plane. Facts and figures in this book were checked against these in July 2026; where a chapter states a price, limit, or GA date, the primary source below is the thing to re-check before relying on it.

Bedrock and the model plane

• Amazon Bedrock user guide, prompt caching: https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html
• Bedrock pricing (on-demand, provisioned, batch at 50% of on-demand): https://aws.amazon.com/bedrock/pricing/
• One-hour prompt caching TTL announcement (January 2026): https://aws.amazon.com/about-aws/whats-new/2026/01/amazon-bedrock-one-hour-duration-prompt-caching/
• Cross-region inference profiles and supported models: https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html
• Intelligent prompt routing (GA April 2025): https://aws.amazon.com/about-aws/whats-new/2025/04/amazon-bedrock-intelligent-prompt-routing-generally-available/
• Claude in Amazon Bedrock (model ids, the Mantle Messages-API endpoint for Opus 4.7 and later, SDK clients): https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock
• Claude Platform on AWS (Anthropic-operated, SigV4, bare model ids): https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws
• Bedrock service quotas (the RPM and TPM meters): https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html
• Bedrock batch inference: https://docs.aws.amazon.com/bedrock/latest/userguide/batch-inference.html
• Bedrock provisioned throughput: https://docs.aws.amazon.com/bedrock/latest/userguide/prov-throughput.html
• Bedrock Guardrails (policies, ApplyGuardrail): https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html

AgentCore and managed agents

• AgentCore general availability (October 13, 2025): https://aws.amazon.com/about-aws/whats-new/2025/10/amazon-bedrock-agentcore-available/
• AgentCore Runtime sessions (8-hour lifetime, microVM isolation): https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-sessions.html
• AgentCore pricing (per-second, CPU billed only while actively consumed): https://aws.amazon.com/bedrock/agentcore/pricing/
• AgentCore Policy and Evaluations (preview December 2025, GA March 2026): https://aws.amazon.com/blogs/aws/amazon-bedrock-agentcore-adds-quality-evaluations-and-policy-controls-for-deploying-trusted-ai-agents/
• AgentCore Gateway concepts (Lambda, OpenAPI, Smithy, and MCP targets): https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-core-concepts.html
• Bedrock Agents Classic maintenance mode (closed to new customers, July 2026): https://docs.aws.amazon.com/bedrock/latest/userguide/agents-classic-maintenance-mode.html
• CloudWatch generative AI observability (GA October 2025): https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/GenAI-observability.html
• AgentCore starter toolkit (the entrypoint shape in Lab 3.1): https://github.com/aws/bedrock-agentcore-starter-toolkit
• MCP specification (the wire shape Lab 3.0 implements: JSON-RPC 2.0, initialize, tools/list, tools/call): https://modelcontextprotocol.io/specification

Serverless skeleton

• Step Functions distributed map (10,000 concurrency, redrive): https://docs.aws.amazon.com/step-functions/latest/dg/state-map-distributed.html and https://docs.aws.amazon.com/step-functions/latest/dg/redrive-map-run.html
• Lambda quotas (15-minute maximum duration): https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.html
• Lambda response streaming (200 MB payloads, July 2025; all commercial regions, April 2026): https://aws.amazon.com/about-aws/whats-new/2025/07/aws-lambda-response-streaming-200-mb-payloads/
• Lambda SnapStart supported runtimes: https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html
• Lambda response streaming: https://docs.aws.amazon.com/lambda/latest/dg/configuration-response-streaming.html
• SQS at-least-once delivery, visibility timeout, and dead-letter queues: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-basic-architecture.html
• EventBridge event bus and rules: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-what-is.html
• Amazon States Language (the Step Functions workflow spec): https://states-language.net/

Firecracker and isolation

• Agache et al., "Firecracker: Lightweight Virtualization for Serverless Applications," NSDI 2020 (boot under 125 ms, under 5 MB overhead per microVM, 150 microVMs per second per host): https://www.usenix.org/system/files/nsdi20-paper-agache.pdf
• Firecracker project: https://github.com/firecracker-microvm/firecracker
• Marc Brooker on Firecracker in production: https://brooker.co.za/blog/2025/09/18/firecracker.html

State and memory

• S3 Vectors general availability (December 2025; scale limits): https://aws.amazon.com/blogs/aws/amazon-s3-vectors-now-generally-available-with-increased-scale-and-performance/
• S3 Vectors limitations and quotas: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-vectors-limitations.html
• S3 Vectors as a Knowledge Bases vector store: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-vectors-bedrock-kb.html
• DynamoDB single-table design and conditional writes: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-modeling-nosql-B.html
• Bedrock Knowledge Bases (managed retrieval, GraphRAG, structured retrieval): https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-bases.html
• OpenSearch vector / k-NN search: https://opensearch.org/docs/latest/search-plugins/knn/index/

Trust and safety

• Bedrock Guardrails prompt-attack detection: https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-prompt-attack.html
• InvokeGuardrailChecks API for agentic workflows (June 2026): https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-bedrock-guardrails-api-ai/
• Securing Bedrock agents against indirect prompt injection: https://aws.amazon.com/blogs/machine-learning/securing-amazon-bedrock-agents-a-guide-to-safeguarding-against-indirect-prompt-injections/
• IAM policy evaluation logic (default deny, explicit-Deny-wins, session policies as intersection): https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html
• STS session policies (an assumed-role session can only narrow): https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session
• Simon Willison, "The lethal trifecta for AI agents" (private data + untrusted content + exfiltration): https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
• Step Functions waitForTaskToken (the human-approval callback): https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html

Protocols and frameworks

• Strands Agents 1.0 (multi-agent primitives, A2A support): https://aws.amazon.com/blogs/opensource/introducing-strands-agents-1-0-production-ready-multi-agent-orchestration-made-simple/
• Strands Agents source: https://github.com/strands-agents/harness-sdk
• Model Context Protocol specification: https://modelcontextprotocol.io/
• A2A protocol under the Linux Foundation (v1.0, 2026): https://www.linuxfoundation.org/press/linux-foundation-launches-the-agent2agent-protocol-project-to-enable-secure-intelligent-communication-between-ai-agents
• Amazon Nova Act general availability (browser automation agents): https://aws.amazon.com/blogs/aws/build-reliable-ai-agents-for-ui-workflow-automation-with-amazon-nova-act-now-generally-available/

Under the hood: the open-source layer

• Cedar policy language (open source, formally verified core; behind AgentCore Policy and Amazon Verified Permissions): https://www.cedarpolicy.com/ and https://github.com/cedar-policy/cedar
• Smithy, AWS's open-source interface definition language: https://smithy.io/
• OpenTelemetry (the tracing standard behind AgentCore Observability) and the AWS Distro for OpenTelemetry: https://opentelemetry.io/ and https://aws-otel.github.io/
• OpenTelemetry generative-AI semantic conventions (standard span attribute names for model/token telemetry): https://opentelemetry.io/docs/specs/semconv/gen-ai/
• Amazon States Language specification (Step Functions' workflow JSON): https://states-language.net/
• DeCandia et al., "Dynamo: Amazon's Highly Available Key-value Store," SOSP 2007 (the paper behind DynamoDB's lineage): https://www.allthingsdistributed.com/files/amazon-dynamo-sosp2007.pdf
• Elhemali et al., "Amazon DynamoDB: A Scalable, Predictably Performant, and Fully Managed NoSQL Database Service," USENIX ATC 2022: https://www.usenix.org/conference/atc22/presentation/elhemali
• OpenSearch (Elasticsearch fork, now under the Linux Foundation): https://opensearch.org/
• Strands Agents documentation: https://strandsagents.com/
• Nova Act SDK (Playwright-based browser driving): https://github.com/aws/nova-act
• AWS on Anthropic and Trainium (Project Rainier): https://www.aboutamazon.com/news/aws/aws-project-rainier-ai-anthropic

Part 1: the loop, tools, and the ledger

• JSON Schema (the language tool parameter specs are written in): https://json-schema.org/
• JSON Lines (the event store's file format): https://jsonlines.org/
• Anthropic tool-use documentation (the real API's message and tool shapes that Lab 1.1's interface mirrors): https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview
• Fowler, "Event Sourcing" (the pattern behind Chapter 9): https://martinfowler.com/eaaDev/EventSourcing.html

Design background

• Anthropic, "Building effective agents" (workflows versus agents, the simplest-thing-that-works default): https://www.anthropic.com/research/building-effective-agents
• Anthropic, "How we built our multi-agent research system" (orchestrator-worker fleets, token economics of multi-agent systems): https://www.anthropic.com/engineering/built-multi-agent-research-system
• Companion books in this series: AI Foundations in Depth, Context Engineering.