The trust problem with agents
According to AWS, enterprises want agents to do more work, but reviewing every step does not scale. Given a task, an agent picks its own tools and sequences steps, and it may take a different route each time. A test that passes today says little about what the agent will do tomorrow.
Human approval does not scale
Having a person approve every agent action works at small scale. As agents take on more work, approvals pile up and review fatigue sets in. AWS argues this leaves capable agents idle on valuable work.
What Trust in Depth proposes
AWS suggests letting agents act on their own when their actions can be verified, reserving human judgment for decisions that need it. The company frames this around four questions:
- Scope (before it runs): What is the agent for, what capabilities does the job require, and what must it never do?
- Know (at deployment): Who authorized it, what identity does it carry, and can you account for every agent acting on your behalf?
- Bound (while it runs): Do its actions stay within the limits you set, and can it still do the job?
- Observe (after each run): Can you reconstruct what the agent did and why?
Automated reasoning enters the picture
Precise rules can be tested, but agents take paths you did not anticipate. AWS points to automated reasoning — mathematical logic that checks whether a rule holds in every possible case under a precise description of the system and its assumptions. AWS says it has run automated reasoning in production for more than a decade, from IAM at over 2.1 billion requests per second to systems like the AWS Nitro Hypervisor, Amazon S3 Block Public Access and VPC Reachability Analyzer.
Not every rule can be proven
"Only a manager can approve access" can be proven; "keep a friendly tone" cannot. Where proof does not apply, AWS recommends limiting the agent's access and actions, evaluating its behavior, and sending genuine ambiguity to a human.
