Amazon Web Services has released Loom for AWS, an open-source platform intended to give enterprises a structured way to build, deploy and govern AI agents. The offering is designed to work with Amazon Bedrock AgentCore and AWS Strands Agents, providing lifecycle management capabilities for agent deployments at scale.
At the core of Loom is a set of controls and automation aimed at meeting enterprise requirements for security, governance and cost attribution. The platform applies automated resource tagging, enforces three required tags on deployed resources and allows additional custom tags. These tagging capabilities are positioned to support governance and accounting for agent-related cloud spend.
Access control in Loom uses a two-dimensional model that pairs role types with group tags to limit user permissions. The platform also supports attribute-based access control in addition to role-based mechanisms.
Deployment of agents under Loom follows a configuration-driven approach rather than relying on runtime code generation. Behavioral policies and security credentials for agents are managed through AWS Secrets Manager. For different user skill levels, Loom supports both lower-code options - using pre-written Python agents - and no-code deployments through AgentCore’s managed harness.
The platform implements OAuth2 configurations and token exchange protocols to carry user identity through chains of agent requests. Loom also connects with AWS Agent Registry, which is currently in public preview, to store and manage records for agents and tools while enforcing governance review steps before production rollout.
To address sensitive operations, Loom includes human-in-the-loop approval workflows. These use the Strands Agents hook framework and Model Context Protocol elicitations to require manual review for specific actions flagged as sensitive.
Loom for AWS is available via AWS Labs on GitHub and is open to community contributions. AWS positions the project as a toolkit for platform engineering teams that are building applications using fully managed AWS services.
Contextual note - The platform is described as a resource for teams focused on secure, governed agent deployment; beyond the facts above, further details about adoption timelines or performance impacts were not provided.