AgentFlo’s Sales Agents Put Rules and Data Above the Model

AI sales agents are being asked to do more than answer product questions: they can create carts, place orders, apply discounts, and reach into customer systems. AgentFlo’s answer is to make the model a participant in those actions, not the final authority. Its Bedrock AgentCore-based design places fixed policy checks around agent actions and relies on current merchant data for prices, products, and customer context.

That split addresses two different ways a commerce agent can fail. A language model can generate a plausible but unauthorized discount or call a tool it should not reach. It can also give a fluent answer based on stale catalog information. AgentFlo separates those problems: its control layer governs what the agent may do, while its data layer supplies the information on which the agent acts.

Two boundaries around a sales conversation

On the action side, AgentFlo applies controls before a request reaches the model, during tool execution, and after the model produces an answer. The pre-request layer handles prompt-injection detection and opt-outs. During execution, AgentCore Gateway and Cedar policies check identity, tool access, and business rules such as maximum discount percentages independently of the model’s reasoning. Post-response filters are intended to block token disclosure and unverified price claims before a customer sees them.

The other boundary is informational. AgentCore Runtime and DynamoDB retain conversation and cart state, while Bedrock Knowledge Bases hold merchant-specific material such as menus, policies, specifications, and promotion calendars. S3 Vector supports semantic product discovery. AgentFlo loads the last 15 messages at the start of a turn, then loads cart data only when intent detection marks a request as cart-related—a design intended to avoid invented prices or quantities.

A system designed to be inspected

Guardrails and grounding are not the whole operating model. AgentFlo uses AgentCore Observability and CloudWatch to trace each interaction from request through tool execution and response. The traces include model latency, tool-call sequences, token usage, and errors; dashboards track active sessions, response times, and call patterns. The platform also records message interactions to S3 through Data Firehose, allowing merchants to calculate cost per conversation and compare it with sales revenue.

The operational controls extend beyond prompts

• Merchant sessions are isolated through dedicated microVMs in AgentCore Runtime, according to AWS.
• IAM permissions and VPC restrictions limit agent-to-service communication and approved network endpoints.
• The system tracks P50 and P95 latency, throughput, and per-merchant, per-agent costs, with alerts for behavior that departs from baselines.

Promising metrics, bounded evidence

AWS says the Salesflo solution, powered by Strands Agents SDK and Bedrock AgentCore, produced a 12% net revenue uplift, 40% higher customer engagement, 15% higher conversion, 8% higher average order value, and 20% higher customer reactivation. Those figures compare agent-assisted journeys with a control group during a 90-day early deployment period. They are AWS-reported early-deployment results, rather than a general performance guarantee.

AgentFlo is also piloting real-time voice agents built with Strands SDK BidiAgent and AgentCore WebRTC support. The proposed system would stream audio in both directions, allow interruptions, and execute tools while a conversation continues. That expands the same governance problem from messaging into live calls: faster interaction raises the value of keeping authorization and data retrieval outside the model’s discretion.