Building a Multi-Agent AI Contract Review Agent on AWS with Strands Agents SDK and Amazon Bedrock

Contract review is one of the most time-consuming, high-stakes tasks in any organisation. A typical vendor agreement takes 2–4 weeks to review, involves multiple stakeholders (Legal, Finance, IT, Business), and carries significant risk if key clauses are missed or misread.

sweta jha

Published Jun 27, 2026

Last modified Jun 27, 2026

Building a Multi-Agent AI Contract Review Agent on AWS with Strands Agents SDK and Amazon Bedrock

GitHub: https://github.com/its-me-sweta/Contract_Review_Agent.git

Introduction

In this post I'll walk through a production-ready, seven-agent AI pipeline that automates the full contract lifecycle — from PDF extraction to DocuSign execution — using:

Strands Agents SDK with @tool decorators
Amazon Bedrock Nova Pro for clause analysis, alternative language generation, and risk narrative
Amazon Textract for PDF and document text extraction with table detection
Amazon Comprehend for entity recognition (party names, dates, obligations)
Amazon DynamoDB for contract repository, approvals, and SOX audit trail
Amazon S3 with KMS encryption and immutable versioning for executed contracts
Amazon SES + SNS for approval emails and legal team alerts
Amazon EventBridge Scheduler for obligation and renewal reminders
DocuSign API (via Lambda) for e-signature execution
AgentCore Runtime for serverless deployment

Architecture Overview

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
                   ┌──────────────────────────────────────────────┐
                   │       FastAPI / REST Layer                     │
                   │   POST /contract/review                        │
                   └───────────────────┬──────────────────────────┘
                                       │ PDF/DOCX Contract Upload
                   ┌───────────────────▼──────────────────────────┐
                   │           Orchestrator Agent                   │
                   │  Contract Type · Risk Routing · SLA · Audit   │
                   └──────────┬────────────────────────────┬──────┘
                               │                            │
              ┌────────────────▼─────┐       ┌─────────────▼────────────┐
              │  Extraction Agent     │       │  Clause Analysis Agent   │
              │  Textract · Comprehend│       │  16 Clause Types         │
              │  Parties · Dates      │       │  RED/AMBER/GREEN Risk    │
              │  Financials · Obligs  │       │  Missing Clauses · Defs  │
              └────────────────┬─────┘       └─────────────┬────────────┘
                               └──────────────┬─────────────┘
                                              │
                   ┌───────────────────────────▼──────────────────┐
                   │           Risk Assessment Agent               │
                   │  Financial · Legal · Operational · Counterparty│
                   │  Composite Score 0–100 · 4-Tier Routing       │
                   └───────────────────────────┬──────────────────┘
                                               │
                   ┌───────────────────────────▼──────────────────┐
                   │           Compliance Agent                    │
                   │  GDPR · HIPAA · Export Controls · FCPA        │
                   │  DPA Terms · Industry Regulations             │
                   └───────────────────────────┬──────────────────┘
                                               │
                   ┌───────────────────────────▼──────────────────┐
                   │           Negotiation Agent                   │
                   │  AI Redlines · 3-Position Counter-Proposals   │
                   │  Negotiation Playbook · Alternative Language  │
                   │  Redlined DOCX for Counterparty              │
                   └───────────────────────────┬──────────────────┘
                                               │
                   ┌───────────────────────────▼──────────────────┐
                   │       Approval & Execution Agent              │
                   │  Risk-Based Routing · SES Approval Email      │
                   │  DocuSign E-Signature · S3 KMS Storage        │
                   │  Contract Repository · EventBridge Reminders  │
                   └──────────────────────────────────────────────┘

Contract Types & Mandatory Clause Requirements

1
2
3
4
5
6
7
8
MANDATORY_CLAUSES = {
    "VENDOR":     ["data_protection", "limitation_of_liability", "termination",
                   "ip_ownership", "insurance"],
    "CUSTOMER":   ["data_protection", "limitation_of_liability", "termination",
                   "sla", "payment_terms"],
    "EMPLOYMENT": ["confidentiality", "ip_assignment", "non_compete", "termination"],
    "REGULATORY": ["data_protection", "audit_rights", "breach_notification", "sub_processor"],
}

Stage 1 — Extraction Agent

Amazon Textract extracts the full contract text including tables:

1
2
3
4
5
6
@tool
def extract_contract_text(document_uri, document_type="pdf") -> dict:
    r = textract.start_document_text_detection(
        DocumentLocation={"S3Object": {"Bucket": bucket, "Name": key}})
    # Async extraction — polls until complete
    # Returns: full text, page count, word count

Amazon Comprehend identifies counterparty names with > 80% confidence:

1
2
3
for ent in comprehend.detect_entities(Text=text[:5000], LanguageCode="en")["Entities"]:
    if ent["Type"] == "ORGANIZATION" and ent["Score"] > 0.8:
        parties.append({"name": ent["Text"], "role": "PARTY"})

Key data extracted: parties + roles, all dates (effective/expiry/renewal), financial terms (value, payment terms, liability cap, penalties), obligations, and governing law.

Stage 2 — Clause Analysis Agent

Analyses 16 clause types and classifies each as RED/AMBER/GREEN:

1
2
3
4
5
6
7
# RED (HIGH RISK) triggers:
is_red = (
    (ctype == "limitation_of_liability" and "uncap" in snippet_lower) or
    (ctype == "indemnification" and "negligence" in snippet_lower) or  # covers vendor's own negligence
    (ctype == "ip_ownership" and "assign" in snippet_lower and "all" in snippet_lower) or
    (ctype == "non_compete" and contract_value > 50000)
)

Missing clause detection is critical — the agent checks for mandatory clauses by contract type and flags any that are absent as automatic HIGH priority issues.

Company Playbook comparison:

1
2
3
4
5
6
STANDARD_POSITIONS = {
    "payment_terms": "Net-30",
    "liability_cap": "12_months_fees",
    "ip_ownership":  "company_owns_all_work_product",
    "data_retention":"30_days_post_termination",
}

Stage 3 — Risk Assessment Agent

Four-dimension risk model (each 0–25, composite 0–100):

Dimension	Max	Key Triggers
Financial Risk	25	Uncapped liability (+10), value > $1M (+10), FX exposure (+2)
Legal Risk	25	Foreign jurisdiction (+8), IP assignment (+7), mandatory arbitration (+3)
Operational Risk	25	Auto-renewal (+7), no SLA with high obligations (+8)
Counterparty Risk	25	Credit rating, sanctions, litigation history

Risk-based approval routing:

1
2
3
4
5
6
7
approval_tiers = {
    risk ≤ 25 and value ≤ $10K:    "AUTO-APPROVE",
    value ≤ $50K:                   "Manager + Legal",
    value ≤ $250K:                  "VP + Legal Counsel",
    value ≤ $1M:                    "CFO + General Counsel",
    value > $1M or CRITICAL:        "CEO + Board + External Counsel",
}

Stage 4 — Compliance Agent

Seven compliance frameworks checked automatically:

GDPR (mandatory for all contracts involving data):

DPA present and complete
Lawful basis for processing identified
72-hour breach notification obligation
International transfer mechanisms (SCCs)
Sub-processor disclosure

HIPAA (triggered if health data detected):

Business Associate Agreement (BAA) in place
PHI safeguards defined

Export Controls (EAR/ITAR):

Counterparty country checked against restricted list
Technology transfer restrictions

Stage 5 — Negotiation Agent

The most powerful stage — AI generates redlines and a 3-position negotiation playbook:

Three-position counter-proposals (Ask → Get → Give):

1
2
3
4
5
"limitation_of_liability": {
    "ask":  "Cap at greater of 12 months fees or $500,000",
    "get":  "Cap at 12 months fees",
    "give": "Cap at 24 months fees with carve-outs for data breach"
}

Alternative language generation via Nova Pro:

1
2
3
4
# Generates 3 options for each flagged clause:
# OPTION 1 (AGGRESSIVE): Strongly favours our company
# OPTION 2 (STANDARD):   Market-standard, balanced
# OPTION 3 (CONCILIATORY): Reasonable concession

Deal-breakers (no compromise accepted):

Uncapped liability
IP assignment without compensation
Non-compete exceeding 1 year
GDPR non-compliance

Stage 6 — Approval & Execution Agent

One-click approval email with full contract summary:

1
2
3
4
5
ses.send_email(
    Destination={"ToAddresses": [approver_email]},
    Message={"Body": {"Html": {"Data": approval_email_html}}}
)
# Includes: risk score, key issues, approve/reject buttons

DocuSign execution via Lambda:

Creates envelope with signing order (internal first, then counterparty)
5-business-day signing deadline
Monitors completion and stores signed document

EventBridge obligation reminders at 90/60/30/14 days before key dates:

1
2
3
4
scheduler.create_schedule(
    ScheduleExpression=f"at({reminder_date}T09:00:00)",
    Target={"Arn": "arn:aws:lambda:...:function:contract-reminder", ...}
)

AWS Infrastructure Summary

Resource	Purpose
Amazon Bedrock Nova Pro	Clause analysis, alternative language, risk narrative
Amazon Textract	PDF contract text + table extraction
Amazon Comprehend	Party name extraction, entity recognition
Amazon DynamoDB (5 tables)	Reviews, repository, approvals, obligations, versions
Amazon S3 (KMS + versioning)	Contract storage, redlined docs, executed contracts
Amazon SES	Approval emails, legal alerts, obligation reminders
Amazon SNS	Legal escalation, high-risk notifications
Amazon EventBridge Scheduler	Renewal/obligation reminders (90/60/30/14 days)
DocuSign (via Lambda)	E-signature execution
AgentCore Runtime	Serverless agent deployment

Try It Yourself

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
git clone https://github.com/its-me-sweta/Contract_Review_Agent.git
cd contract-review-agent
pip install -r requirements.txt
uvicorn main:app --reload

curl -X POST http://localhost:8000/contract/review \
  -H "Content-Type: application/json" \
  -d '{
    "document_uri": "s3://company-contracts/incoming/vendor-agreement-2025.pdf",
    "contract_type": "VENDOR",
    "counterparty_name": "Acme Cloud Solutions Inc.",
    "estimated_value": 85000.00,
    "submitted_by": "procurement@company.com",
    "submitter_email": "procurement@company.com",
    "business_owner_email": "engineering@company.com",
    "urgency": "STANDARD",
    "has_payment_data": false,
    "counterparty_country": "US"
  }'

Built with Strands Agents SDK · Amazon Bedrock Nova Pro · AgentCore Runtime

# strands-agents # agentic-ai # amazon-bedrock # aws-community-builders

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Building a Multi-Agent AI Contract Review Agent on AWS with Strands Agents SDK and Amazon Bedrock

sweta jha

Building a Multi-Agent AI Contract Review Agent on AWS with Strands Agents SDK and Amazon Bedrock

Introduction

Architecture Overview

Contract Types & Mandatory Clause Requirements

Stage 1 — Extraction Agent

Stage 2 — Clause Analysis Agent

Stage 3 — Risk Assessment Agent

Stage 4 — Compliance Agent

Stage 5 — Negotiation Agent

Stage 6 — Approval & Execution Agent

AWS Infrastructure Summary

Try It Yourself