What did AWS report about MoEngage?
In its case study, AWS describes how MoEngage used AgentCore Gateway, a capability of Amazon Bedrock AgentCore, to connect agents to private internal APIs. AWS reports that the deployment serves roughly 400 registered API operations to 10 internal agents across seven AWS Regions.
Rather than asking each product team to build a Model Context Protocol (MCP) server, MoEngage put the MCP layer under its AI Platform team. Product teams describe their APIs through OpenAPI specifications and explicitly identify operations that should become tools. A continuous integration pipeline handles registration and policy application.
According to AWS, the approach saved MoEngage an estimated six months of platform engineering effort. Adding a new API now takes hours rather than days. Those are reported outcomes for MoEngage’s implementation, not a forecast for another business.
How did MoEngage keep agent access under control?
AWS says MoEngage kept the internal API path private. Agent services reach AgentCore Gateway through a VPC interface endpoint, and the gateway reaches internal services through managed egress over Amazon VPC Lattice. Adding an API does not require MoEngage to build a separate network connection for that integration.
Permissions are enforced before tools reach the agent. Each agent authenticates through its own IAM role, and Cedar policies determine which tools it can discover and call. In the example AWS gives, a campaign QA bot can inspect campaign and segment information but does not receive write tools.
MoEngage also keeps tenant, user, role and database context outside model-visible tool arguments. Its client library supplies that information through headers. For tool discovery, the model starts with a search tool and receives relevant candidates rather than loading the entire catalog into its context.
What does this mean for a small or medium business?
The useful lesson is not to copy MoEngage’s scale. It is to separate what an agent can do from what it is allowed to do. An assistant that checks a campaign does not necessarily need permission to launch it. An assistant that reads a customer record does not necessarily need permission to change it.
The case also shows why adding an AI interface is not the whole project. Someone must own permissions, tool descriptions, access reviews and changes to the underlying systems. A smaller business may give these responsibilities to fewer people, but it should still make ownership explicit.
Clear tool descriptions matter too. AWS reports that MoEngage found developer-facing API descriptions led to poor tool selection when reused unchanged. For your own workflow, describe when a tool should be used, what inputs it needs and what it returns. Do not assume a technically accurate description is enough.
What should a business do next?
Choose one bounded workflow, such as checking campaign details or retrieving delivery information. List the information it needs, the actions it could take and the person responsible for approving its access. Begin with read-only permissions where practical, then test whether the agent selects the right tools and stays within its assigned scope.
Before allowing changes to business data, decide which actions require human approval. Test attempts to reach unrelated records, invoke restricted actions or alter identity information. Keep records of tool calls so staff can investigate mistakes. If evaluating AgentCore Gateway, check the documentation: AWS notes that AgentCore feature availability varies by Region.
Businesses considering a different operating approach can also assess Terabot, which gives businesses digital workers: AI workers with their own computers in private virtual machines, working in the apps a team already uses and around the clock. It is in private preview, by invitation only. Whichever approach you assess, define the job and its access boundaries first.
Key takeaways
- AWS reports that MoEngage centralized agent access to roughly 400 API operations while keeping the internal API path private.
- Give each agent only the tools and permissions its job requires, and keep identity outside model-controlled arguments.
- Start with one bounded workflow, assign an owner and test access controls before permitting changes to business data.
Written with AI assistance from the source linked above, and checked against it before publishing. Product names belong to their owners. Check the original source before relying on details.