A production financial-services agent with all seven security layers applied — from a user's question to a fully-audited answer.
Deploy a production-ready financial-services agent that handles customer portfolio queries. It touches market data, customer PII, and per-customer memory — so every one of the seven surfaces is in play at once.
The task: a customer asks "What's my portfolio performance this quarter?" The agent must answer accurately, touch only that customer's data, never execute a trade, leak no PII, and leave a complete audit trail.
Seven layers, one agent. Each maps back to the module that built it.
M2OAuth Token Vault for the market-data API; sessions scoped by actorId.
M3VPC mode, private subnet, no public egress.
M4Cedar permits portfolio reads; forbids trade execution without approval.
M5CMK-encrypted, one namespace per customer, 24-hour TTL.
M4Lambda interceptor logs every tool call; Guardrails block PII in responses.
M6Full OTEL traces, CloudTrail audit, Security Hub monitoring.
M3Org-wide: deny public runtimes, deny unencrypted memory.
Follow one request through all seven layers. Every step is a control you built in an earlier module.
"What's my portfolio performance this quarter?"
Token Vault retrieves the OAuth token for the market-data MCP server.
Cedar permits this agent + this user + portfolio-read action.
Lambda interceptor logs the request; Guardrails check passes.
MicroVM executes in the VPC and calls the market-data tool.
Session summary written to the user-scoped, CMK-encrypted namespace.
Full trace in CloudWatch; CloudTrail captures every event.
Delivered — no PII, no unauthorized data, full audit trail.
Defense-in-depth in one sentence: a prompt-injected agent still can't call an unauthorized tool (policy), reach an unapproved endpoint (network), read another customer's memory (namespace), or leak PII (Guardrails) — and every attempt is on the record (observability).