Quick answer
On August 7, 2026, AWS announced AgentCore Memory, Policy, and the managed harness in AWS GovCloud (US-West) (us-gov-west-1). The launch adds three different building blocks: persisted conversation context and extracted memories, policy enforcement around Gateway tool calls, and a configuration-driven agent loop managed by AgentCore.
This is a regional availability event, not an automatic compliance result. Before a regulated workload uses the new capabilities, verify the exact account and Region, supported APIs, quotas, infrastructure-as-code path, model and external endpoint choices, data flows, retention and deletion, identity boundaries, logs, denial tests, incident response, and approval evidence.
What AWS announced
The official launch separates the capability families clearly:
- Memory: short-term memory for immediate conversation context and long-term memory that extracts persistent insights and preferences across sessions.
- Policy: centralized controls for agent-to-tool interactions. Policies attach to an AgentCore Gateway, which evaluates requests before allowing or denying tool access.
- Managed harness: configuration for an agent’s model, tools, and instructions, while AgentCore handles the execution environment, compute, memory, identity, and observability.
Runtime, Gateway, Identity, built-in tools, observability, and evaluations were already listed in the Region. The new release fills important state, authorization, and orchestration gaps, but each capability has a separate security boundary.
Treat documentation consistency as a launch gate
When checked on August 9, AWS’s launch page and AgentCore release notes both said that Memory, Policy, and Harness were available in us-gov-west-1. The GovCloud AgentCore page listed the Region and no longer named those three services as unavailable.
However, the general AgentCore Region matrix had not yet placed check marks in the GovCloud column for the Harness, Memory, and Policy rows. That discrepancy is not evidence that either document is wrong; it is evidence that an implementation plan should verify the live control plane rather than depend on one table during a fresh rollout.
Record the date, account, Region, console surface, successful read-only API or CLI discovery, current quotas, and AWS Support confirmation if the procurement or authorization decision depends on the capability.
Keep the three control planes separate
| Question | Primary AgentCore capability | What it does not prove |
|---|---|---|
| What context can the agent recall? | Memory | That recalled content is current, authorized, or correct |
| Which Gateway tool call may proceed? | Policy | That every action bypassing that Gateway is controlled |
| Who runs the model-tool loop? | Harness | That the selected model, tool, filesystem, or network path is approved |
Memory can surface sensitive or stale information. Policy can protect only traffic in its evaluation path. A managed harness can reduce custom orchestration code without removing the need to constrain models, tools, identities, files, outbound connections, budgets, or human approval.
Review GovCloud-specific differences
AWS’s GovCloud guide currently lists several differences that affect architecture:
- Gateway semantic search is not available.
- AWS Agent Registry preview is not available.
- Bedrock Guardrails Policy and Temporal Policy are not available.
- Several CloudFormation resource types, including AgentCore Policy and PolicyEngine resources, are not available.
- Customer-configured external tool, identity, browser, or Code Interpreter network paths can send data plane traffic to customer-selected endpoints outside GovCloud.
- AgentCore metadata must not contain export-controlled data; the guide describes limited support-investigation metadata paths and customer-initiated outbound cases.
This means “runs in GovCloud” is not a complete data-residency statement. Draw the complete path for prompts, events, memory records, model calls, tool payloads, identity exchanges, logs, files, browser traffic, code execution, support metadata, and backups.
A bounded adoption workflow
1. Establish availability and ownership
Confirm the GovCloud account, us-gov-west-1, service access, APIs, quotas, billing owner, support path, and the team responsible for each resource. Preserve screenshots or command output only where your evidence-handling policy allows it.
2. Classify every data path
List data entering short-term events, long-term extraction, model prompts, tools, logs, files, and external endpoints. Mark prohibited fields and metadata separately. Decide whether memory is disabled, managed, or supplied as an existing resource.
3. Define agent and human authority
Map the caller, actor, session, harness execution role, Gateway identity, downstream authorization, policy engine, and approver. Deny-by-default assumptions should be verified with negative tests, not inferred from configuration names.
4. Pilot Policy in observation mode
Review generated Cedar rather than treating a natural-language prompt as the enforceable specification. Use LOG_ONLY to compare expected and observed decisions, cover allow and deny cases, and restrict the UpdateGateway permission that can change or remove enforcement.
5. Validate operations and exit
Test memory deletion and isolation, stale or poisoned memory, tool failure, policy denial, session timeout, endpoint rollback, log access, incident containment, cost alarms, and resource cleanup. Keep an alternative architecture if a required GovCloud feature or infrastructure-as-code path is unavailable.
Frequently asked questions
Which new AgentCore capabilities did AWS announce for GovCloud (US-West)?
AWS announced AgentCore short- and long-term memory, Policy for Gateway tool interactions, and the managed agent harness in AWS GovCloud (US-West), whose Region code is us-gov-west-1.
Does this AgentCore launch make an agent compliant?
No. Regional service availability is not a compliance determination. The customer still owns data classification, authorization, network paths, retention, logging, model and endpoint selection, testing, records, and approval for the applicable control framework.
Are AgentCore commercial-Region features identical in GovCloud?
Do not assume parity. AWS documents GovCloud-specific differences, including unavailable Gateway semantic search, Agent Registry preview, Bedrock Guardrails Policy, Temporal Policy, and some CloudFormation resources. Recheck the live documentation and account before design approval.
Why should teams verify availability in their account?
AWS launch and release notes announced the capabilities on August 7, 2026, while the general Region feature matrix had not yet marked all three GovCloud cells when checked on August 9. Confirm the console, API, quotas, and support documentation for the exact account and Region.
Continue by decision
- Choose short-term versus long-term AgentCore Memory.
- Design Cedar-backed Gateway policy for GovCloud.
- Run the AgentCore GovCloud readiness check before a pilot.
- Compare the managed loop with the n8n versus AgentCore Harness guide.
Official sources
- AWS launch: Memory, Policy, and Harness in GovCloud (US-West)
- AgentCore release notes
- AgentCore supported Regions
- AgentCore in AWS GovCloud (US)
- AgentCore Harness documentation
Source check: August 9, 2026. Recheck current Region support, documented differences, APIs, infrastructure-as-code resources, quotas, prices, model access, and external data paths before implementation.