AI That Reaches Into Your Enterprise Systems, Not Just Content
Stack9 AI Agents runs on Amazon Bedrock AgentCore, connecting agents to CRM, ERP, finance and claims systems under the same identity, permission and audit controls as every other authenticated workflow — with every function call secured through your identity provider and AI processing kept inside the AWS Sydney region.
The Anatomy of a Stack9 AI Agent
Every agent is a versioned, reviewable artefact — six settings a configurator sets, not a black box no one remembers approving.
What an AI agent actually is, and who decides it
Set by an AI Agent configurator in Stack9 AI Studio
Goal & Instructions
what engineers call the system prompt
What this agent is for, who it serves, its tone, and the rules it must not break
Tools & Skills
what it is allowed to do
Retrieve a claim document, calculate benefits, check a policy clause — each a named, reviewable permission
Knowledge
what it is allowed to know
Which policy wordings and product disclosure statements it may read, version-stamped so every answer cites its source
Memory
what it carries forward
What it remembers within a conversation, so a follow-up question does not start over
Identity & Permissions
who it acts as
Runs as the claims officer it is assisting, so it can never reach further than that person could
Guardrails
what it must not do
How it handles questions outside coverage, and what it declines and escalates rather than guesses
Measured in production
Observability
Every answer traceable to the sources it drew on and the tools it called
Evaluations
Automated scoring against expected answers — before release and continuously
End-User Feedback
Ratings and comments captured against real answers to real questions
- Configured in Stack9
- Managed AWS service
- Data & measurement
- A person / user
- Loop / feedback
What an Agent Can — and Can’t — Do
Grounded in Your Sources
Agents answer only from your approved authoritative sources, retrieved live through MCP tools or reindexed, version-stamped content — never from a model trained on your data.
Refusal Is a Feature
Where the sources don't support an answer, an agent says so and hands off to a human channel with the full transcript — rather than generating one anyway.
Acts as the User
Each call into another system runs under the credentials of the person the agent is assisting — so it can never reach further than that person could.
Chat and In-Form Guidance
A conversational assistant answers in plain English, or sits beside a form guiding the user filling it in — built once in the Web App Template, then reused (Custom, not switched on).
Exposed to Agents via MCP
Stack9's own functions — creating content, running automations, reading or writing platform data — reach agents as MCP tools under the same identity and permission model as every other integration.
One Question, Many Specialists, One Accountable Answer
An orchestrator agent interprets a request and delegates each part to a specialist agent, then assembles their findings into one answer for you to review.
One hard question, three specialists, one answer
A claims officer asks, in plain language
“Claim CLM-10482 has three new medical invoices attached. Are they covered, what’s payable, and is anything unusual?”
Claims Concierge — the orchestrator agent
Works out what is being asked and which parts need different expertise, then decides which specialists to call.
It answers nothing itself — its job is to understand, delegate and assemble
delegates each part
Document Processing Agent
what the documents say
Reads each invoice and extracts provider, service, dates and amounts
Tools- Retrieve document
retrieve_document - Process document
process_document
- Retrieve document
Policy Coverage Checker Agent
what the policy covers
Checks each service against the policy wording and works out what is payable
Tools- Calculate benefits
calculate_benefits
- Calculate benefits
Fraud Agent
what looks unusual
Compares billing against expected patterns and raises anything that needs a closer look
Tools- Detect billing anomaly
detect_billing_anomaly - Generate fraud alert
generate_fraud_alert
- Detect billing anomaly
each returns its finding
Claims Concierge assembles one answer
Three findings — what was billed, what is covered and payable, and what needs a closer look — each marked Complies, Does Not Comply or Attention Required.
Every finding traces back to a named tool and a cited source
What the claims officer receives
A findings chain to agree with or override, item by item
Assessment support, never a decision — the officer stays the decision-maker
Agents and tools shown are illustrative; the actual set is designed per engagement.
Three States, Never a Silent Approval
| State | What it means |
|---|---|
| Complies | The material supports the finding outright — checked against the source and cited, ready for a back-office user to confirm. |
| Does Not Comply | The material clearly contradicts the finding — the agent states what was checked and why it does not hold, with the source cited. |
| Attention Required | The material doesn't let the agent decide either way — nothing is silently approved, and the item is flagged for a human to resolve. |
See how these findings sit inside Stack9’s evaluation gate, audit trail and lifecycle controls on AI Governance.
How Stack9 Functions Reach an Agent
Pick your queries and automations
In Console → App Builder → MCPs, create an MCP server and add tools — each backed by an entity-backed query or a webhook-triggered automation.
Get a secure MCP URL
Stack9 generates one endpoint per server: {coreBaseUrl}/api/mcp/{mcpKey}. Copy it from the "Get MCP URL" action.
Connect your AI agent
Point any MCP-capable client at that URL over Streamable HTTP, secured with OAuth 2.1 through your identity provider — audience-bound bearer tokens and PKCE, not a shared secret.
Agents call tools, Stack9 enforces the rules
Every call is checked against real entity read privileges and automation permissions before it runs. No permission, no result — fail closed, every time.
Follow the guide to exposing MCP tools, or see how a client such as Claude Code connects using OAuth 2.1.
The Limits, Stated Plainly
Every capability above runs inside the same identity, audit and residency model described in Security & Architecture.
- Connecting a new data source or tool needs a developer, once. After that, business users create and schedule agents against it independently — and complex, client-specific function-calling integrations remain development work, not configuration.
- Evaluation datasets are authored, not pre-built. The benchmark questions and their correct outcomes are built per engagement with your own subject-matter experts — the evaluation tooling in AI Studio is native, the dataset behind it is not.
- AI answers are bounded by model inference, not application speed. A complex enquiry can take longer than a conventional transaction; the response streams as it forms, and AI response times are baselined and reported separately from transactional ones.
- Conversational UI, history and in-form placement are Custom, built once then reused. Cards, follow-up prompts and a form-side AI Assistant are built in the Web App Template; image and video de-identification is a separate custom pipeline built per client.
- No fine-tuning on client data, and a draft finding is never a decision. Agents ground answers in live, version-stamped content instead — citable, correctable, and never absorbed into a model. Decision authority stays with your people. AI prompt-to-app remains roadmap only.
Make Your Stack9 Instance Agent-Ready
Business users build and schedule agents once the underlying data or tool is connected — configure them in Stack9 AI Studio, and expose your own functions to any MCP-capable client.