AWS announced Step Functions workflows as AI agent tools on October 29, 2026. The AgentCore Gateway connector exposes workflows through the Model Context Protocol. For teams reviewing the integration, one practical distinction deserves its own checklist: a pinned state machine and the permissions for an execution-level call are different controls.

Conceptual illustration of a cloud engineering desk with separate workflow cards and a policy notebook.
Conceptual illustration of a cloud engineering desk with separate workflow cards and a policy notebook.

AWS’s October 29 connector announcement

Read each operation’s target

AWS’s connector guide identifies StartExecution, StartSyncExecution, ListExecutions and DescribeStateMachine as pinnable operations. Their stateMachineArn is configured on the target. DescribeExecution, StopExecution and GetExecutionHistory instead take an executionArn supplied by the agent; the gateway service role’s IAM policy controls which executions those calls can reach.

AWS connector guide: pins and execution permissions

Review the three execution-ARN operations separately from the start operation. A screenshot showing the intended workflow pin does not, by itself, document the role policy used for those follow-up calls. Keep the target configuration and the applicable policy together in the review record.

If your team also uses Agent Registry, test catalog discovery separately from the tool’s execution permissions.

Prepare a bounded evaluation

AWS’s tutorial uses a Standard state machine and scopes its sample gateway policy to that workflow. It demonstrates starting a run and checking the result. Follow its prerequisites, supported operations and cleanup instructions when adapting the example; resources can incur charges.

AWS tutorial: scoped Standard-workflow example

  • Inventory: list the tools exposed by the proposed gateway target.
  • Start target: record the configured state machine for each pinnable operation included.
  • Follow-up access: record the intended execution scope for the three execution-ARN operations.
  • Evidence: retain the reviewed policy version and dated results from an authorized test environment.
  • Outcome: distinguish permission to inspect a run from permission to stop it.

Walk through a fictional review

Imagine a fictional team evaluating a gateway for a training workflow called OrderReview. Its review sheet identifies that workflow as the intended start target and its runs as the intended scope of follow-up inspection. The reviewer asks the platform owner to show both configuration and policy evidence.

The team writes down expected behavior before an authorized test: which training run should be visible, which separate test scope should remain inaccessible and whether stopping a run is needed at all. It compares observed results with those expectations and keeps any discrepancy open for investigation.

This is an original review exercise, not a deployed AWS configuration or a tested permission guarantee. Use non-production resources and approved test cases. Never treat an agent’s natural-language promise to stay within a workflow as evidence that the underlying access has been limited.

For a separate agent-security example, compare intended access with enforced network, file and execution controls in the OpenShell checklist.

Keep the review specific

Record the workflow type, chosen operations and exact policy being reviewed. If any of them changes, revisit the affected expectations rather than carrying forward an old sign-off. Keep unknown results marked unknown and ask the responsible platform owner to resolve them.

The useful deliverable is a small evidence record connecting intended access, configured controls and observed behavior. No AWS account, gateway, IAM policy, execution or billing outcome was tested for this guide. This article covers a focused review question, not a complete deployment procedure.

Check the operation scope