HEMA builds HAL on Amazon Bedrock AgentCore, cutting portal searches to seconds

HEMA's knowledge problem had two layers. Structured infrastructure knowledge was in good shape: a service catalog mapped people to teams, teams to services, and services to APIs and business capabilities. But procedural questions like how to request API access or provision a group had no single home. As HEMA grew and onboarded new engineers, the informal "just ask the person next to you" model broke down, scattering answers across portals and wikis.

The solution grew in two deliberate steps. First, a standalone assistant with its own chat UI, backed by a Strands agent on AgentCore runtime. Second, opening that knowledge to the tools people already use, through a second AgentCore Gateway authenticated with Microsoft Entra ID rather than AWS credentials. The hard part was authentication: MCP clients expect Dynamic Client Registration, which HEMA emulated with a stubbed /register endpoint returning a fixed client ID.

Before going live, HEMA tested HAL in a staging environment with engineers and business users for one month. The stakes now hinge on the action layer: because the underlying portals are already API-enabled and integrated with Entra ID single sign-on, HEMA believes the same authentication and authorization model can secure write operations, starting with AWS account provisioning. Whether that works in practice will determine if HAL becomes a true action assistant or stays a read-only knowledge layer.