Every developer has experienced the creeping dread of documentation debt. It usually begins with a simple database schema change—a new column here, a modified foreign key there—and ends with an ER diagram that is fundamentally a lie. This phenomenon, known as document drift, creates a dangerous gap between the actual state of the production environment and the mental model the team relies on. Parallel to this is the security bottleneck, where critical deployments stall for days while a human reviewer manually cross-references code against a mountain of CVE databases and internal policy documents. The friction is not in the coding itself, but in the administrative glue that holds software engineering together.
The Infrastructure of AI-Driven Development
Amazon Bedrock AgentCore addresses these bottlenecks by establishing a runtime infrastructure for the AI-driven Development Life Cycle (AI-DLC). Rather than treating AI as a standalone chatbot, AgentCore provides containerized agents, persistent memory, and secure gateways that integrate directly into the deployment pipeline. One of the most immediate applications of this is the automation of SQL schema visualization. When a developer checks in SQL code to a repository, an event-driven architecture triggers the process. An Amazon S3 trigger invokes an AWS Lambda function, which in turn activates the AgentCore runtime. The agent analyzes the Data Definition Language (DDL) and transforms the logical structure into a .mmd file, a text-based definition for Mermaid ER diagrams, which is then stored back in S3.
Security is handled through a strict principle of least privilege. The agent is restricted to reading schema metadata—table structures, constraints, and foreign keys—without ever accessing the actual row data stored within the tables. This ensures that the AI can maintain the documentation without violating corporate data privacy policies. To implement this, developers use the BedrockAgentCoreApp runtime wrapper and register handlers using the @app.entrypoint decorator.
@app.entrypoint
def handle_sql_to_mermaid(event, context):SQL 스키마 분석 및 Mermaid 다이어그램 생성 로직
pass
The full source code for this automation is available in the GitHub repository.
Beyond documentation, AgentCore tackles the security review bottleneck through a multi-agent analysis system. When code is pushed to S3 via a GitLab pipeline, a Strands-based agent begins a deep scan of Python and Java source files. Utilizing the Anthropic Claude Sonnet model via Amazon Bedrock, the system evaluates the code for vulnerabilities and policy violations. The agent does not work in isolation; it uses the AgentCore Gateway to call Model Context Protocol (MCP) tools running on AWS Lambda. These tools perform the heavy lifting of querying CVE databases and verifying compliance with organizational security standards.
To prevent redundant analysis and enable rapid retrieval, the results are stored in AgentCore memory, allowing for semantic searches across previous security audits. The output is a quantified quality score from 1 to 10, accompanied by specific remediation advice delivered to a real-time web dashboard. This entire operational flow is secured via Amazon Cognito and monitored through a combination of AgentCore Observability and Amazon CloudWatch. The implementation details for this secure handoff can be found in the sample-agentic-secure-software-handoffs repository.
The Hybrid Shift from Local Iteration to Cloud Governance
While the automation of diagrams and security scans is impressive, the true architectural shift lies in the bifurcation of the agent environment. Most AI tools attempt to do everything in one place, but AgentCore recognizes that the needs of a developer during the design phase are fundamentally different from the needs of a system during the deployment phase. This leads to a hybrid structure where local agents handle the creative and iterative work, while the cloud runtime handles the governed and event-driven work.
In the early stages of the AI-DLC—specifically the Inception and Construction phases—tools like Kiro provide structured specifications and custom agent skills to refine requirements and minimize design errors. This is complemented by Claude Code, a local CLI agent. The distinction is critical: Claude Code operates in the developer's immediate environment, handling the granular implementation details that require constant human intervention and rapid feedback. Once the developer validates the code locally, the output is handed off to the server-based AgentCore runtime, which executes the standardized automation workflows for deployment and verification.
This separation of concerns is made possible by the Model Context Protocol (MCP). By using MCP, AgentCore remains model-agnostic. It can integrate external coding agents, such as OpenAI Codex, by treating their capabilities as standardized skills. For instance, the SQL-to-Mermaid workflow is not locked into a specific model; it is a skill that can be routed to any compatible agent via the MCP server. This creates an open architecture where the team can swap models as better ones emerge without rewriting the entire pipeline.
This workflow forms a sequential chain: Kiro handles the structural design, Claude Code manages the local implementation, and AgentCore oversees the deployment and automated governance. To optimize this, the system employs the bolt pattern, where developers use local agents to run extremely short cycles of implementation and verification. Instead of building a massive feature and hoping it passes the security scan, the developer iterates in tiny bursts, using the AI to test hypotheses in real-time. This distributes the risk of large-scale design errors across many small, manageable iterations.
Governance is maintained through a human-in-the-loop architecture. While the AI leads the proposal of architectures and the generation of deployment artifacts, the final technical decisions remain with the human team. The AI suggests the path, but the human steers the direction, ensuring that technical precision is never sacrificed for the sake of speed. By modularizing these components, the system ensures that changing a model in the security phase does not break the documentation phase, maintaining high maintenance efficiency.
For teams looking to adopt this AI-DLC strategy, the path is incremental. The first step involves validating a single-agent flow using the SQL-to-ER diagram sample to measure accuracy and lower the entry barrier. The second step expands this into a multi-agent system by integrating the AgentCore Gateway and MCP tools to increase the quality of the agent's context. The final stage is the integration of the secure software handoff sample into the CI/CD pipeline, transitioning the human role from a primary reviewer to a final decision-maker.
The strategic choice is clear: use CLI-based tools like Claude Code for the rapid, iterative chaos of local development, and deploy cloud-based AgentCore for the structured, event-driven requirements of production operations.
The shift from AI as a productivity tool to AI as a runtime infrastructure marks the end of the manual handoff era.
