Solv Labs built an AI agent payment workflow on Amazon Bedrock AgentCore payments to address the enterprise challenge of proving that autonomous agent payments are authorized, risk-priced, and auditable. The solution combines AgentCore payments for payment processing, ORACLE (Solv's policy engine) for pre-authorization, ICME PreFlight for privacy-preserving compliance verification, and AWS Nitro Enclaves for hardware attestation. Each transaction completes in under four seconds and produces a complete audit trail with cryptographic proofs, hardware attestations, per-transaction risk pricing, and on-chain anchoring via Coinbase and Base blockchain. The system enables enterprises to deploy agent payments in regulated environments with verifiable governance at machine speed, scaling review effort with exceptions rather than transaction volume.
Solv Labs developed a production-grade AI agent payment workflow that addresses one of the most critical challenges in deploying autonomous agents in enterprise and regulated environments: proving that each payment transaction was properly authorized, risk-assessed, and compliant with policy. The case study represents a convergence of multiple infrastructure capabilities that emerged in 2026, including Amazon Bedrock AgentCore payments (introduced May 2026), AWS Automated Reasoning Checks, AWS Nitro Enclaves for hardware attestation, and the x402 payment standard for agent-to-service payments.
The fundamental problem Solv Labs addresses is the governance gap that emerges when autonomous systems move real money. Unlike traditional software systems where authorization can be reviewed after the fact, agent payments create immediate financial consequences. Enterprises need to prove to auditors, regulators, and counterparties that each payment was authorized under the correct policy, priced for its risk, and recorded in a tamper-proof manner. The challenge isn’t merely executing the payment—it’s producing durable, verifiable evidence that ties each specific transaction to the policy framework that authorized it.
This case study is notable for combining multiple layers of production infrastructure to create what the authors describe as transaction-level verifiable governance. However, readers should note that this is a co-marketed piece published on the AWS blog, written jointly by Solv Labs, ICME Labs, and AWS personnel. While the technical architecture appears sound, the claims about performance, completeness, and enterprise adoption should be evaluated with appropriate scrutiny, as is standard for vendor-published case studies.
The system is built around Amazon Bedrock AgentCore as the foundational agent orchestration platform. AgentCore provides the runtime environment for the AI agents themselves, with the payment workflow integrated natively into this environment. This native integration is architecturally significant because it means the governance infrastructure inherits the agent’s identity, gateway, and observability surfaces, avoiding the common failure mode of parallel control planes that create configuration drift and security gaps.
The payment workflow operates through five specialized components that execute in a fixed sequence before any payment settles. This sequence is enforced as an absolute gate: no governance decision means no settlement. The components are ORACLE for pre-authorization, ICME PreFlight for independently verifiable policy checks, an integrity service running in AWS Nitro Enclaves for hardware attestation, a risk engine for per-transaction pricing, and AgentCore payments itself for payment processing and settlement through Coinbase.
ORACLE serves as the pre-authorization layer. Before any agent payment executes, ORACLE evaluates the proposed action against the applicable policy framework and returns either an ALLOW or REVIEW determination. The architecture explicitly prevents policy failures from producing settled transactions that must be unwound after the fact. The ORACLE engine includes a fully implemented DENY path that produces signed refusal records when configured constraints are violated, though the case study notes this primarily through the lens of ALLOW and REVIEW paths in production.
ICME PreFlight provides the policy verification layer that makes governance decisions independently verifiable. This component extends AWS Automated Reasoning Checks by producing cryptographic proofs that can be verified by third parties without exposing the underlying policy details or transaction parameters. The privacy-preserving property is critical for regulated environments where policy details may be proprietary or confidential. According to the case study, these proofs can be verified in under one second, though the methodology for this measurement isn’t detailed.
AWS Nitro Enclaves provide hardware-level attestation for the execution record. An integrity service runs inside the Nitro Enclave and signs each execution record within this hardware-isolated environment. The Nitro Security Module produces attestation documents that bind the signing key to specific enclave image measurements (PCR0, PCR1, and PCR2). This means verifiers can confirm not just that a record was signed inside an enclave, but that it was signed inside the specific enclave image that Solv Labs has published. This prevents silent rewriting of records after execution and provides a hardware root of trust for the governance chain.
The risk engine computes a per-transaction risk multiplier deterministically from assessed violation signals. Rather than treating all transactions as identical from a governance perspective, the system prices the risk carried by each transaction individually. These risk multipliers feed into downstream review prioritization and, where applicable, can inform pricing of risk transferred to third parties. The case study notes that risk multipliers reflect the engine’s operating point and that outcome calibration accrues as observed executions accumulate, suggesting a learning or adaptive component, though details on this mechanism are limited.
AgentCore payments handles the actual payment processing while enforcing per-session spending limits independently of agent or policy engine decisions. Settlement completes with on-chain routing through Coinbase, with transactions anchored to the Base blockchain networks for public verifiability.
The end-to-end transaction latency is reported at under four seconds, covering pre-authorization, governance, payment processing, and on-chain settlement. Governance overhead specifically is reported to be under one second. These performance characteristics are positioned as fitting within the latency budgets of agentic workloads, though what constitutes acceptable latency will vary by use case. For high-frequency trading applications, four seconds per transaction would be prohibitive; for procurement agents or expense automation, it may be entirely acceptable.
Each governed payment produces a single signed evidence record that binds five elements: the evaluated policy, the policy-check result with its independently verifiable proof, the hardware-attested execution record, the per-transaction risk price, and the settlement artifacts from AgentCore payments. The evidence record is canonicalized and signed with Ed25519 signatures inside the Nitro Enclave, then anchored on-chain for public verifiability.
The case study is explicit about what this evidence does and does not attest. It does not attest that the agent’s underlying decision was wise, that the counterparty is solvent, or that the policy itself is correct—those remain the operator’s responsibility. What it does attest, in a verifiable manner, is that the specific payment was evaluated against the specific policy under the specific constraints at the specific risk price, and that this evaluation authorized settlement. This scoping is appropriate and honest about the limits of automated governance.
All governance components feed into standard AgentCore Observability, which integrates with Amazon CloudWatch for logs, metrics, and traces. This unified observability surface means operators don’t need separate monitoring infrastructure for governance versus agent behavior. Every decision, attestation, risk price, and settlement appears in the same operational dashboards and alerting infrastructure used for the rest of the agent system.
The case study emphasizes that this observability is structured for multiple audiences: Risk and Compliance teams, Internal Audit, and external auditors and counterparties. Each of these stakeholders can verify different aspects of the evidence trail without requiring access to the operator’s policy details, transaction parameters, or private keys. The public blockchain anchoring enables external verification without compromising confidential business logic.
From an LLMOps perspective, this case study illustrates several important patterns for production AI agent deployment. First, it demonstrates the necessity of governance infrastructure that operates at the same speed as the autonomous systems it governs. Sub-second governance overhead means the control systems don’t become the bottleneck as agent workloads scale.
Second, the architecture shows how to implement defense in depth for autonomous systems. AgentCore payments enforces spending limits at the infrastructure level, independent of what the agent or policy engine decides. ORACLE provides pre-authorization before values move. The Nitro Enclave provides hardware-isolated attestation. The risk engine provides per-transaction pricing. No single component is responsible for preventing all failure modes; instead, multiple independent layers provide overlapping protection.
Third, the system demonstrates how to make autonomous agent behavior auditable in regulated environments. The combination of cryptographic proofs, hardware attestation, and blockchain anchoring creates an evidence trail that survives disputes and satisfies regulatory scrutiny. The privacy-preserving nature of the proofs means enterprises can demonstrate compliance without exposing proprietary policies or transaction details.
Fourth, the architecture addresses the operational challenge of review at scale. Because every transaction carries its own evidence and clears a policy gate before settlement, review shifts from sampling every Nth transaction to investigating the exceptions that the evidence itself flags. This means oversight work scales with the exception rate rather than the transaction rate, which is essential for making agent systems economically viable at production scale.
The case study notes that the marginal cost of governing one more payment is dominated by the AgentCore call itself, with proof generation and blockchain anchoring as incremental costs on top of infrastructure enterprises already pay for. This is positioned as avoiding a new budget line item, though actual cost structures would depend on transaction volumes and pricing agreements with AWS and Coinbase.
While the technical architecture appears sound, several aspects warrant careful consideration. The case study is explicitly a co-authored piece involving the vendor (AWS), the implementing company (Solv Labs), and a partner technology provider (ICME Labs). This creates natural incentives to present the solution in the most favorable light.
The performance claims—four seconds end-to-end, under one second for governance—are presented without details on testing methodology, transaction volumes, or workload characteristics. Real-world performance will depend heavily on policy complexity, network conditions, blockchain congestion, and system load. The case study doesn’t discuss failure modes, retry logic, or degraded performance scenarios.
The evidence trail is described as “independently verifiable,” but the actual verification process requires reference verifier tooling from Solv Labs and ICME. The degree to which this is truly independent verification versus vendor-provided verification tools is not entirely clear. The blockchain anchoring provides public verifiability of the anchored hashes, but verifying what those hashes actually represent requires the vendors’ tooling and specifications.
The risk engine’s “deterministically computed risk multiplier” and its “outcome calibration accruing as observed executions accumulate” suggest some form of learning or adaptive system, but the details are notably vague. How risk signals are assessed, what violation signals are considered, and how the system adapts over time are all critical questions for enterprises evaluating this approach, but they remain unanswered in the case study.
The deployment model is described as running “in a Solv-operated environment” for AgentCore payments, which suggests that enterprises may not be running this entirely within their own infrastructure. The security and compliance implications of this deployment model would need careful evaluation, particularly for highly regulated industries.
The case study mentions that the DENY path is “fully implemented and unit-tested” but focuses almost entirely on ALLOW and REVIEW paths in the description. The handling of edge cases, system failures, network partitions, and other fault scenarios is not discussed.
Despite these caveats, the case study articulates a clear value proposition for enterprises deploying autonomous agents in production. The combination of pre-authorization, hardware attestation, risk pricing, and public anchoring addresses real governance gaps that would otherwise prevent agent deployment in regulated environments. The ability to produce verifiable evidence for each transaction without exposing policy details is genuinely valuable for compliance-heavy industries.
The shift from sampling-based review to exception-based review has significant operational implications. If the system delivers on this promise, it could fundamentally change the economics of agent oversight, making it feasible to deploy agents at scales that would be impossible with traditional audit approaches.
The integration with existing AgentCore infrastructure is architecturally sound and avoids the common pitfall of bolted-on governance that creates parallel control planes and configuration drift. The unified observability surface and the leveraging of infrastructure enterprises already pay for both reduce operational complexity and incremental costs.
The case study demonstrates integration across a sophisticated technology stack. Amazon Bedrock AgentCore serves as the orchestration layer, providing the runtime environment for the agents themselves. AWS Nitro Enclaves provide hardware-isolated attestation with roots of trust in the Nitro Security Module. AWS Automated Reasoning Checks provide the foundation for formal policy evaluation, which ICME extends with zero-knowledge proof generation for privacy-preserving verification.
Coinbase provides the cryptocurrency payment rails and settlement infrastructure, with transactions anchored to the Base blockchain networks (Coinbase’s layer-2 Ethereum solution) for public verifiability. The x402 payment standard provides the protocol layer for agent-to-service payments, enabling interoperability across different agent systems and service providers.
The evidence records use Ed25519 signatures for cryptographic signing, with signing operations occurring inside the Nitro Enclave to ensure the signing keys are never exposed to the host environment. The attestation documents include PCR measurements (Platform Configuration Registers) that bind signatures to specific enclave images, enabling verifiers to confirm not just that attestation occurred, but that it occurred in the expected secure environment.
This case study represents an important data point in the maturation of AI agent infrastructure. It demonstrates that the industry is moving beyond proof-of-concept agent deployments toward production systems with enterprise-grade governance, compliance, and auditability. The convergence of agent orchestration (AgentCore), formal verification (Automated Reasoning Checks), hardware attestation (Nitro Enclaves), blockchain anchoring (Base), and payment rails (Coinbase) in a single quarter of 2026 suggests that the ecosystem for production agent deployment is rapidly maturing.
For LLMOps practitioners, the case study highlights the importance of designing governance and observability infrastructure from the beginning rather than retrofitting it after deployment. The native integration of governance into the agent runtime environment, the unified observability surface, and the infrastructure-level enforcement of spending limits all represent architectural decisions that would be difficult to add after the fact.
The emphasis on verifiable evidence and independent auditability also signals a recognition that autonomous systems create fundamentally different accountability challenges than traditional software. When a system makes decisions and takes actions without human intervention, the ability to prove what happened and why becomes a core requirement, not an optional feature.
The shift toward per-transaction evidence trails rather than system-level compliance certifications (like SOC 2 reports) represents a more granular approach to governance that may become standard for autonomous systems operating in regulated environments. This transaction-level accountability could inform regulatory approaches to AI governance more broadly.
Smartling operates an enterprise-scale AI-first agentic translation delivery platform serving major corporations like Disney and IBM. The company addresses challenges around automation, centralization, compliance, brand consistency, and handling diverse content types across global markets. Their solution employs multi-step agentic workflows where different model functions validate each other's outputs, combining neural machine translation with large language models, RAG for accessing validated linguistic assets, sophisticated prompting, and automated post-editing for hyper-localization. The platform demonstrates measurable improvements in throughput (from 2,000 to 6,000-7,000 words per day), cost reduction (4-10x cheaper than human translation), and quality approaching 70% human parity for certain language pairs and content types, while maintaining enterprise requirements for repeatability, compliance, and brand voice consistency.
This panel discussion features engineering leaders from Abridge, Replit, and Hebbia discussing their experiences building sophisticated AI agent systems at production scale. Abridge tackles clinical documentation by recording and summarizing doctor-patient conversations for over 250 healthcare systems, addressing challenges around clinical compliance and trust. Replit builds autonomous coding agents that can plan, design, write, test, and debug software with increasingly long-running capabilities. Hebbia creates AI tooling for major financial institutions like KKR and Morgan Stanley, managing extremely spiky workloads with hundreds of thousands of agents processing high-value questions worth hundreds of millions of dollars. All three companies leverage Temporal for durable execution, have moved beyond proof-of-concept to production systems with high stakes, and share common challenges around reliability, cost optimization, model selection, and the evolving balance between agent autonomy and human control.
Snorkel developed a specialized benchmark dataset for evaluating AI agents in insurance underwriting, leveraging their expert network of Chartered Property and Casualty Underwriters (CPCUs). The benchmark simulates an AI copilot that assists junior underwriters by reasoning over proprietary knowledge, using multiple tools including databases and underwriting guidelines, and engaging in multi-turn conversations. The evaluation revealed significant performance variations across frontier models (single digits to ~80% accuracy), with notable error modes including tool use failures (36% of conversations) and hallucinations from pretrained domain knowledge, particularly from OpenAI models which hallucinated non-existent insurance products 15-45% of the time.
