How do you build AI agents inside your own cloud and model approval process?

To build AI agents inside your own cloud and approval process, start from the model service your security team already approved. Keep traffic on private network paths, read the data and retention terms for each model, log every call, and test the agent before you widen access. Do not add a new vendor path.

Clarity by Epistemic Me is an AI-native services firm that offers done-with-you and done-for-you evals consulting for AI agents.

Why build on the cloud you already approved?

Your security and legal teams have already reviewed your cloud. A new model vendor means a new review. If the agent calls a model through a service you already govern, the approval is narrower: this model, in this region, with these settings.

AWS, Microsoft and Google each publish data terms for their hosted model services. Those terms differ, so read them for the service you pick. The next sections summarize what three providers’ own docs say, as of 2026-10-30. Check the live pages before you rely on any statement. They change.

What do the cloud providers say about your data?

Cloud service	What the provider’s docs say	Source
Amazon Bedrock	Model providers do not have access to the model deployment accounts, so they do not have access to Bedrock logs or to customer prompts and completions.	AWS data protection docs
Microsoft Foundry (models sold by Azure)	Prompts, completions, embeddings and training data are not available to other customers or to OpenAI or other model providers, and are not used to improve their models.	Microsoft Learn, updated May 2026
Google Cloud Gemini Enterprise Agent Platform (formerly Vertex AI)	Google says it will not use your data to train or fine-tune any AI/ML models without your prior permission. Customer data is retained for limited periods in some scenarios, such as abuse monitoring, grounding and caching.	Google Cloud docs

Read the fine print. Each provider keeps some data for some reason. Microsoft describes abuse monitoring, where a sample of prompts and completions may be reviewed, and a path to apply for modified abuse monitoring. Google describes limited retention for abuse monitoring, grounding and caching, and says some features cannot reach zero retention. AWS says that some models require data retention for safety and abuse prevention.

Your approval document should say which of these retention paths you accept.

How do you keep agent traffic private?

On AWS, you can create an interface endpoint with AWS PrivateLink for Bedrock. AWS says you can then reach Bedrock “without the use of an internet gateway, NAT device, VPN connection, or Direct Connect connection” (AWS, Amazon Bedrock docs). Instances in your VPC do not need public IP addresses to reach it.

You can also attach an endpoint policy. The default policy allows full access to Bedrock through the endpoint. A custom policy limits which principals can take which actions on which resources.

Private network paths control how traffic travels. They do not, by themselves, decide how long a provider retains data. Treat network privacy and data retention as two separate checks.

How do you control data retention for each model?

Check retention per model, not per cloud. AWS documents that Bedrock lets you set a data retention mode by Region, at account or project level. Project-level settings apply only on the bedrock-mantle endpoint. The modes include none (zero data retention), default, and aws_review. A model declares which modes it allows. If your mode is below what a model requires, the model is unavailable to you (AWS, Amazon Bedrock data retention docs).

AWS says that, for models that require human review, data is retained within the AWS boundary for up to 30 days and may be reviewed by AWS. It states that the content is not shared with the model provider. AWS also says ZDR access for Anthropic Claude models is managed by Anthropic.

This gives your approval team a concrete control. AWS shows that you can use IAM policies or Service Control Policies to restrict which retention modes can be set. For example, a policy can require none across the organization. A model that needs retention then stays off until someone with authority changes the policy.

What should the approval checklist contain?

Use a checklist that maps to what you can verify. Here is a starting list.

1. Model and region. Name the exact model and the region. Approval for one model does not cover another.
2. Network path. State whether traffic uses private endpoints, and which endpoint policy applies.
3. Data retention. State the retention mode. Record who may review data and for how long.
4. Data classes. List which data the agent may send to the model. Exclude the rest.
5. Logging. State what you log, where, and who can read it.
6. Access. State which roles can call the model and change settings.
7. Test results. Attach pass/fail results from a test set of real cases.
8. Rollback. State how to turn the agent off.

The last two items matter most to the business. A security review tells you the agent is safe to connect. Test results tell you the agent is good enough to use.

How do you log and audit agent calls?

Turn logging on before launch. On Bedrock, model invocation logging collects invocation logs, model input data and model output data for all invocations in your account in a Region. It can deliver to Amazon CloudWatch Logs or Amazon S3, in the same account and Region. AWS documents it as disabled by default (AWS, Amazon Bedrock docs).

Each log record includes the model ID, the caller’s identity, input and output bodies, and token counts. Callers can add request metadata, such as a team or environment tag. Those tags help you trace cost and behavior back to one agent.

Logs hold full prompts and responses, so they may hold sensitive data. Set access controls and retention on the log store as part of the approval.

How do you test the agent before wider access?

Test on real cases, in a limited setting. Anthropic recommends “extensive testing in sandboxed environments, along with the appropriate guardrails” for autonomous agents (Anthropic, 2024-12-19). Anthropic’s engineering team also says “20-50 simple tasks drawn from real failures” is a strong place to start (Anthropic, 2026-01-09).

Widen access in steps. Move from the test set, to a small group of expert users, to a wider group. At each step, compare against the baseline and check the logs. For metrics to watch early, read What should you track in the first days of an AI agent pilot?

FAQ

Can we keep our data inside our own cloud account?

Not exactly. On Bedrock, models run in deployment accounts that AWS owns and operates, not in your account. AWS says model providers cannot access those accounts or your prompts and completions. Microsoft says Foundry data is not available to model providers such as OpenAI. Read the retention terms for your exact model.

Does a private endpoint mean the provider keeps no data?

No. A private endpoint controls the network path. Retention is a separate setting. AWS, Microsoft and Google each describe some retention for abuse monitoring or other features.

Do we need a new approval for each model?

Plan on it. AWS says each model declares the retention modes it allows. A model that needs human review needs a retention mode your policy may not currently permit. Ask your security team whether a model change counts as a new review.

What if our approved cloud does not offer the model we want?

Ask your cloud team first. Choosing a model that your approved service offers can be faster than opening a new vendor review. If the model is only available elsewhere, expect a separate review of that path.

How Clarity can help

Clarity by Epistemic Me is an AI-native services firm. It builds AI agents with client teams and offers evals consulting for AI agents. The first phase of an engagement is Sprint Zero: review inputs, establish a baseline and agree the first increment. Engagements start at $100K+, and the proposal sets scope, deliverables and duration. See /services/ and /evals/, and read what an AI-native services firm is.

Sources

• AWS — Data protection in Amazon Bedrock (accessed 2026-10-30)
• AWS — Data retention in Amazon Bedrock (accessed 2026-10-30)
• AWS — Interface VPC endpoints (AWS PrivateLink) for Amazon Bedrock (accessed 2026-10-30)
• AWS — Monitor model invocation using CloudWatch Logs and Amazon S3 (accessed 2026-10-30)
• Microsoft — Data, privacy, and security for Foundry Models sold by Azure (updated May 2026)
• Google Cloud — Gemini Enterprise Agent Platform and zero data retention (accessed 2026-10-30)
• Anthropic — Building effective agents (2024-12-19)
• Anthropic — Demystifying evals for AI agents (2026-01-09)