Sofvie launches a production AI data agent 28 days early on Amazon Bedrock
Amazon Bedrock
AWS Fargate
Amazon RDS for MariaDBVeUP built Sofvie a production foundation-model agent — not a chatbot bolted onto a database. An MCP server running on AWS Fargate orchestrates identity-scoped tools against Sofvie’s multi-tenant industrial-safety data, with Amazon Bedrock Nova Premier deciding when and how to call them, and a guardrail stack — JWT-routed tool authority, AST-validated SQL, PII redaction, and an adversarial prompt-injection test corpus in CI — keeping every tool call inside its tenant boundary.
The challenge
Sofvie’s SaaS platform holds safety-critical operational data for industrial and mining customers in a strict database-per-client isolation model. The company wanted its analytical users to ask questions in natural language and get grounded answers from their own data — but an agent with tool access to multi-tenant data raises the hardest questions in applied agentic AI: how does the agent’s authority get scoped to the requesting user’s tenant, how are generated queries proven safe before they run, and how is the system hardened against prompt injection trying to walk it across a tenant boundary? Sofvie needed a partner who could answer those questions in production, not in a demo.
The solution
VeUP designed the workload as an agent from the ground up. An MCP server on AWS Fargate exposes Sofvie’s data operations as typed tools; Amazon Bedrock Nova Premier plans and orchestrates the tool calls needed to answer each question. Agent authority is identity-scoped: the requesting user’s JWT routes every tool invocation to that tenant’s database and nothing else. Every SQL-producing tool output passes a deterministic AST validation gate before execution, and PII redaction sits between tool results and the agent’s context window. Bedrock Guardrails wrap the conversation surface. Robustness is engineered like software, not vibes: an adversarial prompt-injection corpus runs in CI, a 100+ question golden set regression-tests tool-call selection accuracy on every change, and in-product thumbs feedback feeds a human-in-the-loop improvement signal. Amazon CloudWatch instruments the agent’s full cost and health signature in production.
Production outcomes
| KPI | Result |
|---|---|
| Agent telemetry | Measured production cost signature of 2 Amazon Bedrock invocations and ~42 MCP tool calls per question — the signature of a genuine tool-using agent, with planning and orchestration doing the work rather than a single-shot completion. |
| Delivery & safety | Production agent live four weeks ahead of the contracted date, with zero cross-tenant incidents since go-live — the identity-scoped tool authority and AST validation gates holding in production. |
| Robustness discipline | Prompt-injection adversarial corpus running in CI; 100+ representative-question golden set regression-testing MCP tool-call selection accuracy on every release; thumbs-feedback loop growing the evaluation corpus from real usage. |
| Lessons & continuation | Agent authority belongs in the identity layer, not the prompt — JWT-routed tool scoping plus deterministic output validation is what makes a multi-tenant agent shippable; adversarial testing in CI turns prompt-injection defense from a launch checkbox into a regression suite. |
AWS IAM
Amazon CloudWatch