Reference flow
- User -> authentication and role context -> router -> RAG retriever -> knowledge base/vector index -> MCP server for approved tools.
- Bedrock receives minimal context, Guardrails and application policy validate answers and tool calls, and human approval enters when the action is sensitive.
- Logs, traces, and the evaluation set capture metadata, sources, permissions, and cost without storing sensitive prompts by default.



