Agentcore Claims — Development skill for Claude Code

Claims Agent: Amazon Bedrock AgentCore Observability, Policy, Registry

A hands-on demo of three Amazon Bedrock AgentCore capabilities that I, **Trần Đức Anh**, built and ran on a real AWS account, using one insurance claims agent from start to finish.

[Tiếng Việt bên dưới](#tiếng-việt)

Part	Service	What the demo shows
1	AgentCore Observability	Every session, trace and span of the agent in CloudWatch GenAI Observability, with no instrumentation code. The trace reveals the agent submitting a 50,000 USD claim on a policy capped at 5,000 USD.
2	AgentCore Policy	Tools moved behind AgentCore Gateway and guarded by Cedar policies: default deny, a permit for claims up to 10,000 USD, and a forbid rule generated from a plain-English sentence ("forbid wins"). Every denial is visible in the trace.
3	AWS Agent Registry	The tools (MCP record) and the agent (Custom record) published to a private registry, with the Publisher → Admin approval → Consumer search flow. Records are not discoverable until approved.

The agent

• Claims Agent, an insurance assistant written with Strands Agents, model Claude Haiku 4.5 on Amazon Bedrock.
• Runs on AgentCore Runtime (us-east-1), deployed with the AgentCore CLI (CodeZip build, no Docker).
• Three tools on mock data: get_policy, get_claim_status, submit_claim.
• Mock policies: POL-1001 (auto, limit 5,000 USD), POL-1002 (home, 20,000 USD), POL-1003 (expired).

Architecture


The customer calls the Claims Agent on AgentCore Runtime, which invokes Claude Haiku 4.5 on Amazon Bedrock. Every tool call goes through AgentCore Gateway over MCP with SigV4; the Gateway asks the Policy Engine (Cedar, ENFORCE) to authorize it, and only allowed calls reach the ClaimsTools Lambda