Amazon Bedrock AgentCore vs Orchestrator Zero
oz0 records agent jobs running on your infrastructure. AgentCore supplies managed AWS services for running and governing agents. oz0 provides a control plane you host, outbound-only nodes on your machines and access to local and cloud models.
What Amazon Bedrock AgentCore is
Amazon Bedrock AgentCore is AWS's managed platform for building, deploying and operating agents with any framework and model. Runtime runs each session in its own microVM, Gateway turns APIs, Lambda functions and MCP servers into MCP tools under Cedar policies, and other services cover identity, memory, code, browsing, observability and evaluations.
docs.aws.amazon.com- Runs
- Managed service
- Checked
- 27 October 2026
Side by side.
Amazon Bedrock AgentCore's ratings come from its own pages. A column's name opens its definition and how Orchestrator Zero does it. How we rated
Where it runs
Any machine you own
Yes
DocsConditional: Runtime runs in AWS only
Runtime runs agents only on compute AWS provisions and operates, at most on EC2 instances in your AWS account.
Linux, macOS and Windows
No: AWS cloud, Linux only
Agents run only in AgentCore Runtime in AWS, as containers or on Linux EC2 instances that AWS manages; nothing is installed on your own Linux, macOS or Windows machines.
Self-hosted control plane
Yes
DocsNo: Managed AWS service
AgentCore is a managed AWS service; there is no control plane to run yourself.
No inbound ports
Yes
DocsNo: Platform calls the agent
The platform proxies each request to the agent's HTTP server, so the agent has to accept inbound calls.
Fleet operations
Yes
DocsNo: AWS manages all compute
AWS provisions, patches, scales and tears down the compute; there are no machines of yours to join, label, route to or block.
Durability
Durable runs
Conditional: Storage, not step replay
MicroVM session storage is in preview; Instances volumes and attached filesystems offer other persistence options. Persisting files across restarts does not by itself resume an interrupted agent at its last completed step.
Governance
Tool policy outside the model
Conditional: Cedar allow and deny
Policy checks every tool call through AgentCore Gateway against Cedar permit and forbid rules, outside the agent's code. The rules allow or refuse; nothing makes a call wait for a person, and tools called without the gateway are not covered.
Approvals in chat
Conditional: Inline function, your own UI
A harness inline function pauses the agent and hands the call to your code, which can ask a person; there is no built-in approval step or chat app integration.
Tool snapshots
Yes
DocsConditional: Cached schema until resync
The gateway serves the tool definitions it indexed when the target was created until an admin synchronises again; it does not flag a changed tool.
Tenants built in
Yes
DocsConditional: Tenant mapping is yours
Each session gets its own microVM, but AgentCore does not map sessions to users or tenants; that mapping is yours.
Cost
Budgets that stop a run
Conditional: Token caps, no money budget
Token usage is tracked and a token budget can cap an invocation, but there is no spend limit in money per run.
Security
Provider keys off the workers
Yes
DocsConditional: Gateway for OpenAI, Anthropic
Gateway inference targets keep OpenAI and Anthropic keys in AgentCore Identity and add them to outbound requests, but the target is optional, and Bedrock models are called with the runtime's own IAM role, so the runtime holds credentials.
Sandbox with an egress allowlist
Conditional: Sandbox, allowlist via VPC
Code Interpreter and harness sessions run in isolated microVMs, but there is no host allowlist: keeping egress to listed hosts takes your own VPC and routes.
Audit and compliance
Tamper-evident audit trail
Yes: Enable logging and validation
Enable both Gateway data-event logging and CloudTrail log-file validation. Gateway calls then have audit events, and CloudTrail produces signed, chained digest files that let you verify the delivered logs.
Erasure by key
Conditional: Delete per actor, no own keys
Memory events are stored per actor and session and can be deleted for good, but encryption uses one KMS key per memory resource, with no key per person.
Retention with legal hold
Conditional: Expiry settings, no legal hold
Memory events expire after a period you set between 3 and 365 days, but AgentCore has no legal hold; S3 Object Lock on a CloudTrail bucket would be your own setup.
Openness
Model provider choice
Yes
DocsYes
Runtime and the harness work with models in and outside Bedrock, including OpenAI, Gemini, Claude, Nova, Llama and Mistral, and the harness takes a custom OpenAI-compatible endpoint, a self-hosted one included.
Where Amazon Bedrock AgentCore is stronger.
Managed and serverless
AWS runs and scales the compute for every agent session, so there are no servers to operate.
docs.aws.amazon.comSOC, ISO and CSA STAR
AgentCore is in scope for SOC 1, 2 and 3 reports and is ISO and CSA STAR certified.
docs.aws.amazon.comPolicies checked before use
Tool policies can be written in plain English, are turned into Cedar, and are checked by automated reasoning for rules that are too broad, too narrow or can never match.
docs.aws.amazon.comA/B tests on live traffic
AgentCore can split live traffic between two versions of an agent to test a change before it rolls out, and suggests prompt and tool description changes from production traces.
docs.aws.amazon.com
Differences to examine.
Compare the scope, conditions and editions in the source notes.
- Any machine you own
- Linux, macOS and Windows
- Self-hosted control plane
- No inbound ports
- Fleet operations
- Tool snapshots
- Tenants built in
- Budgets that stop a run
- Provider keys off the workers
- Erasure by key
Using both
Every Orchestrator Zero agent is also an MCP tool and an A2A agent, so an AgentCore agent can call one, and AgentCore Gateway can front it as an MCP server target.
Based on documentation; this pairing has not been tested.
Find your first task.
Explore an example or read the public Docs preview. Software access is coming soon.