What did AWS publish?
AWS describes an architecture that connects an AI agent to a governed semantic layer built with the Denodo Platform. The walkthrough brings together customer data in Amazon Aurora, order data in Amazon Redshift, and rewards enrollment data in an on-premises PostgreSQL database. It is an implementation guide, rather than an announcement of a new product launch.
According to AWS, Amazon Bedrock AgentCore hosts the agent, while the Denodo MCP Server exposes governed data views through the Model Context Protocol (MCP). A foundation model on Amazon Bedrock plans queries. Denodo Virtual DataPort executes them against the underlying sources and combines the results. Business definitions, joins, and access filters sit in the semantic layer rather than in the prompt.
The example asks which high-spending customers have not joined a rewards program. Answering requires information from all three sources. AWS explains that the architecture queries those sources without moving source data between engines. Query results still travel back to the agent.
Why does a semantic layer matter to a smaller business?
A semantic layer gives software a shared definition of business concepts. For an SME, that could mean agreeing on what counts as customer spending before asking an AI assistant to identify valuable accounts. Otherwise, different reports or assistants may interpret the same request differently. In the AWS example, reusable metric definitions sit alongside customer views.
The broader business lesson is that data preparation deserves as much attention as the chat interface. An assistant cannot reliably resolve inconsistent customer identifiers or disputed metric definitions just because its prompt is well written. Start by deciding which records belong together and who owns each definition.
This architecture may be relevant when useful information is spread across systems that must remain in place. But it should not become the default answer to every reporting problem. If one well-managed report can answer the question, compare that simpler route before committing to a distributed query architecture.
What should managers check before approving a pilot?
Start with permissions. AWS describes an identity flow that passes the human user's identity through Amazon Bedrock AgentCore to Denodo. Denodo then resolves the caller to a role and applies access policies. Its Global Security Policies can enforce row filters and column masks at query time. The important management question is whether each employee sees only the information their role permits.
Next, check the data itself. Choose a shared customer identifier, document the spending calculation, and decide how missing rewards records should be interpreted. Ask the implementation team to test incomplete records and conflicting identifiers, not just a clean demonstration. An answer that sounds reasonable still needs to reconcile with the underlying records.
Finally, ask for a clear operating plan. Who maintains definitions, reviews permissions, investigates incorrect answers, and monitors source-system load? Assess deployment and ongoing support effort alongside the usefulness of the answers. Treat these as pilot acceptance criteria, not work to postpone until after rollout.
What practical steps should an SME take next?
Pick one read-only business question with an answer your team can verify manually. List the required fields, their source systems, the matching identifiers, and the roles allowed to see them. Define the metric once. Then compare the pilot's answers with your existing records and test the same question under different user permissions. Read the AWS walkthrough for the architecture and implementation details.
Keep answering questions separate from taking action. Identifying customers without rewards enrollment does not, by itself, justify enrolling them automatically. Decide which actions require human approval before expanding beyond a read-only pilot.
For a separate approach to business automation, Terabot gives businesses digital workers: AI workers that each have their own computer, a private virtual machine, work in the apps a team already uses, and work around the clock. It is in private preview, by invitation only.
Key takeaways
- AWS presents an architecture for querying distributed business data through shared definitions and caller-specific access controls.
- For SMEs, consistent identifiers, agreed metrics, and tested permissions should come before a broader AI rollout.
- Begin with one verifiable, read-only question and compare the proposed architecture with simpler alternatives.
Written with AI assistance from the source linked above, and checked against it before publishing. Product names belong to their owners. Check the original source before relying on details.