Every agent action on Bedrock,
independently judged before it executes.

# strands_veridect.py
import os, requests
from strands import Agent
from strands.hooks import BeforeToolCallEvent

VERIDECT = os.environ["VERIDECT_URL"]
HEADERS  = {"Authorization": f"Bearer {os.environ['VERIDECT_API_KEY']}"}
SCOPE    = "may look up orders and may issue refunds up to $500 on existing orders"   # this agent's configured authority — yours to set, never the model's

def veridect_gate(event: BeforeToolCallEvent) -> None:
    verdict, record = "unavailable", ""                                  # closed until proven open
    try:
        r = requests.post(f"{VERIDECT}/api/ai/consensus/pre-action", headers=HEADERS, timeout=60, json={
            "action": event.tool_use["name"],
            "target": f"strands:{event.tool_use['name']}",
            "parameters": event.tool_use["input"],
            "callingAgent": event.agent.name,                                 # the agent object Strands hands the hook — not a model output
            "callingAgentScope": SCOPE,
            "department": "customer_service",
        })
        d = r.json() if r.status_code == 200 else {}
        verdict, record = d.get("verdict", "unavailable"), d.get("auditBundleId", "")
    except Exception:
        pass                                                               # network, timeout, parse: all stay closed
    if verdict != "greenlight":
        event.cancel_tool = f"Veridect {verdict} — record {record}"         # explicit cancel; the model sees why

agent = Agent(name="strands-support-agent", tools=[lookup_order, issue_refund])
agent.add_hook(veridect_gate)   # event type inferred from the hint

# action_group/handler.py
import os, json
AUTHORITY = json.loads(os.environ["AGENT_AUTHORITY_JSON"])      # {"bedrock-order-status-agent": "read-only: may look up order status and tracking",
                                                             #  "bedrock-ap-agent": "may schedule payments on approved invoices below the dual-approval threshold"}
def handler(event, context):
    params = {p["name"]: p["value"] for p in event.get("parameters", [])}
    agent = event["agent"]["name"]                                # set by Bedrock on the invocation event — not a parameter the model fills in
    scope = AUTHORITY.get(agent)
    if scope is None:
        return respond(event, "Not executed — no configured authority for this agent.")   # never asked, never run
    verdict, record = "unavailable", ""                              # closed until proven open
    try:
        d = veridect_pre_action({
            "action": event["function"],
            "target": f"bedrock-agents:{event['actionGroup']}",
            "parameters": params,
            "callingAgent": agent,
            "callingAgentScope": scope,                                # its configured authority, in words
            "department": "customer_service",
        })
        verdict, record = d.get("verdict", "unavailable"), d.get("auditBundleId", "")
    except Exception:
        pass                                                       # network, timeout, parse: all stay closed
    if verdict != "greenlight":
        return respond(event, f"Not executed — Veridect {verdict} (record {record}).")
    return respond(event, do_the_work(event["function"], params))

def respond(event, text):
    return {"messageVersion": "1.0", "response": {
        "actionGroup": event["actionGroup"], "function": event["function"],
        "functionResponse": {"responseBody": {"TEXT": {"body": text}}}}}

# 1) once — register the AgentCore Gateway as an upstream (admin call)
POST /api/ai/consensus/mcp/upstreams/{tenant}
{ "upstreamId": "agentcore-prod",
  "url": "https://<gateway-id>.gateway.bedrock-agentcore.<region>.amazonaws.com/mcp",
  "enabled": true }

# 2) the agent's MCP client — before
MCP_URL = "https://<gateway-id>.gateway.bedrock-agentcore.<region>.amazonaws.com/mcp"

# 2) the agent's MCP client — after
MCP_URL = "https://<your-veridect-host>/api/mcp/gateway/agentcore-prod"
HEADERS = {
  "Authorization":            f"Bearer {VERIDECT_API_KEY}",       # your Veridect tenant
  "X-Upstream-Authorization": f"Bearer {agentcore_access_token}", # forwarded to the Gateway as Authorization
}

# 3) what the agent sees on a greenlight: the upstream's own result, plus
#    result._meta["veridect/verdict"] and result._meta["veridect/bundleId"]
#    on escalate / block: a JSON-RPC error (-32003 / -32004) carrying the
#    verdict and the record id — and the Gateway never receives the call.