The Legend of AWS Warrior (Part 2 - The AWS Design): Zero-Trust Serverless Referee, Amazon Bedrock AgentCore Runtime and Single-Table DynamoDB Architecture

3-Part Technical Blog Series:  Part 1 covers the Game and Pedagogy , Part 2 covers the AWS Serverless and AgentCore Design, and  Part 3 covers Autonomous Question Generation with Strands Multi-Agent Graphs .

1. Introduction: Why Conversational Chatbots Fail as Academic Graders

2. End-to-End Serverless Architecture ( template.yaml )



3. Why  API Gateway -> Lambda -> AgentCore Runtime ? The Zero-Trust Referee Pattern

Why not connect API Gateway directly to Amazon Bedrock AgentCore Runtime? Why place an AWS Lambda function in the middle?



4. Inside the Amazon Bedrock AgentCore and Strands Harness Runtime



4.1 Hardened Single-Turn Strands Harness Grader ( src/VoiceAgent/agent.mjs )

// src/VoiceAgent/agent.mjs
import { createHarness } from "@strands-agents/harness";
import { BedrockModel } from "@strands-agents/sdk";

export function createAgent({ send, modelId = process.env.VOICE_MODEL_ID } = {}) {
  const invoke = async (system, input, maxTokens) => {
    const model = new BedrockModel({
      modelId,
      maxTokens,
      temperature: 0,
      stream: false,
      clientConfig: { maxAttempts: 3, retryMode: "adaptive" },
    });
    const strandsAgent = await createHarness({
      model,
      effort: "auto",
      caching: false,
      systemPrompt: system,
      builtinTools: [],
      builtinPlugins: [],
      contextManager: false,
      session: false,
      memory: false,
      skills: false,
      backgroundTasks: false,
      printer: false,
      retryStrategy: null,
    });
    const result = await strandsAgent.invoke(JSON.stringify(input), { limits: { turns: 1 } });
    if (!["end_turn", "endTurn"].includes(result.stopReason)) throw new Error("Incomplete model response");
    const raw = result.toString();
    if (raw.length > 30000) throw new Error("Model response too large");
    const fenced = /^```(?:json)?\s*([\s\S]*?)\s*```$/i.exec(raw.trim());
    return JSON.parse(fenced ? fenced[1] : raw);
  };
}

4.2 Operation-Dispatched Multi-Persona Grading ( grade_reading  vs.  grade_answer )

````
```
* **Core AI Task**: **STT-Aware Passage Alignment** assessing passage coverage (`0..70`) and content fidelity (`0..30`).
* **Output JSON Contract**: `{"score": 85, "breakdown": {"coverage": 60, "content": 25}, "feedback": "..."}`
* **Phase 1 Validator (`validateReadingGrade`)**: Enforces integer bounds (`0..70`, `0..30`, `score = coverage + content`) and blocks voice or pronunciation claims.
* **Phase 2 Scoring (`VoicePracticeFunction`)**: Lambda checks `score >= 60` and maps `60 / 75 / 90` to `5 / 10 / 15 MP`.
```
````

4.3 Two-Phase Algorithmic Verification and Anti-Voice-Claim Guardrail

5. Single-Table DynamoDB Design, Atomic MP Transactions and Classroom Fairness

5.1 Single-Table Schema ( VoicePracticeTable )

5.2 Classroom Assessment Fairness: Sticky Shuffle, Zero Leakage and LRU Rotation

6. CloudFormation, SAM and Dual-Stack DevOps ( Game Mode  vs.  Exam Mode )

7. Continue to Part 3: Autonomous Question Generation with Loop Engineering and Strands Multi-Agent Graphs

With 302 AWS services—and AWS constantly updating security defaults, service limits, and features—how do we author, fact-check against official AWS documentation, translate into English, Cantonese, and Mandarin, and calibrate hundreds of interview Q&A rubrics without human bottleneck or LLM hallucination?