Build a semantic layer for agentic AI on AWS with AtScale and Amazon Bedrock AgentCore

The post demonstrates how to construct a governed customer‑360 semantic layer on Amazon Redshift using AtScale, then expose that layer to a Strands agent running on Amazon Bedrock AgentCore via the AtScale MCP server. Identity propagation, row‑level security, RBAC, and full query audit are all enforced at the semantic layer, ensuring that the agent can safely retrieve and act on data without compromising governance. The integration showcases a practical pathway for deploying agentic AI workflows on AWS while maintaining strict data‑access controls.

⚡ Key Takeaways

• AtScale MCP server serves as the bridge between the semantic layer and Bedrock AgentCore, exposing the MCP to the agent.
• Row‑level security and RBAC policies defined in Amazon Redshift are preserved through the AtScale semantic layer.
• Full query audit logs are captured by AtScale, providing end‑to‑end traceability for agent‑generated queries.
• Identity propagation allows the Strands agent to inherit the calling user’s permissions, ensuring consistent access control.
• WhyItMatters: Engineers building production agentic AI on AWS can now combine Bedrock AgentCore’s multi‑step reasoning with a rigorously governed semantic layer, reducing data leakage risk while enabling secure, auditable AI interactions.
• TechnicalLevel: Intermediate
• TargetAudience: ML Engineers
• PracticalSteps:
• Deploy AtScale MCP server and configure it to expose the semantic layer to Bedrock AgentCore.
• Define row‑level security and RBAC rules in Amazon Redshift and propagate them through AtScale.
• Enable identity

Engineers building production agentic AI on AWS can now combine Bedrock AgentCore’s multi‑step reasoning with a rigorously governed semantic layer, reducing data leakage risk while enabling secure, auditable AI interactions.

✅ Practical Steps

1. Deploy AtScale MCP server and configure it to expose the semantic layer to Bedrock AgentCore.
2. Define row‑level security and RBAC rules in Amazon Redshift and propagate them through AtScale.
3. Enable identity

Want the full story? Read the original article.