Compare · AWS AgentCore
The best bundled runtime, if you live in AWS.
AgentCore is the most complete production stack any hyperscaler ships: per-session microVMs, memory, identity, a tool gateway, a browser, a code interpreter, and observability. If your whole estate is AWS, start there.
01 / credit where it is due
We would recommend it ourselves for a single-cloud team.
AgentCore Runtime gives each session an isolated microVM with sessions that run for hours. Gateway turns APIs and Lambdas into governed tools. Identity integrates with Cognito and IAM. It is framework-agnostic across LangGraph, CrewAI, Strands, and the OpenAI and Claude SDKs. This is not a weak product, and pretending otherwise would waste your time.
It is also bundled into a bill you already pay, which is the same structural advantage CloudWatch had over Datadog. Any honest comparison starts by admitting that is a real moat.
02 / where it stops
The gap we exist to fill.
- One cloud
- AgentCore is AWS-shaped by design. If your data lives in GCP, your identity in Entra, or your inference on-premise, you are building the bridge yourself — and the boundary stops being a single boundary.
- Policy depth
- Gateway authorises access to a tool. It is not a general pre-execution decision point over arguments, amounts, blast radius, and business hours, and it does not carry a human-approval primitive with signed authorisations.
- Evidence, not logs
- Observability emits traces to CloudWatch, which the emitting account can rewrite and which sample by design. There is no tamper-evident chain, no signed approval inside the record, and no verifier you can run yourself.
- Egress control
- You get VPC networking and can build egress rules. You do not get default-deny egress with per-session allowlists and pinned resolution as a product primitive of the runtime.
- Air-gapped
- Not available. For defence, parts of healthcare, and some financial estates, that ends the conversation before features matter.
- Portability
- Sessions, policy, and audit history are AWS-resident concepts. Moving off means rebuilding the boundary, which is precisely the lock-in a platform team is usually trying to avoid.
03 / side by side
| Velone | AWS AgentCore | |
|---|---|---|
| Isolation | Firecracker microVM per session | Firecracker microVM per session |
| Session length | Indefinite, suspend and resume | Up to about 8 hours |
| Clouds | AWS, GCP, Azure, bare metal, air-gapped | AWS |
| Models | Any provider or local weights | Any, but Bedrock is the happy path |
| Policy | Pre-execution gate on tool, args, amount, time, blast radius | Tool-level authorisation via Gateway |
| Human approval | First-class, signed, in the record | Build it yourself |
| Audit | Hash-chained, verifiable, exportable | CloudWatch traces |
| Egress | Default deny, per-session allowlist, pinned | VPC rules you configure |
| Deployment | Managed, BYOC, air-gapped | AWS managed |
| Commercial | Licence, portable | Consumption on your AWS bill |
04 / choosing
Pick the right one.
choose them when
- Your agents, data, models, and identity are all already in AWS
- You expect that to stay true for the next three years
- Consumption billing on an existing commitment matters more than portability
- Bedrock is your inference layer and you are happy there
- You do not need a tamper-evident record for an auditor or regulator
choose velone when
- You mix Claude, GPT, Gemini, and local models, and intend to keep mixing
- Data or inference lives in more than one cloud, or in your own data centre
- Security wants the boundary inside your perimeter, not in a vendor account
- An auditor will ask you to prove what an agent did and who approved it
- You need human approval on irreversible actions as a product feature, not a project
- Air-gapped or sovereign deployment is a requirement, not a preference
05 / questions
Can we use both?
Yes, and some teams do. Run AgentCore as the harness host and Velone as the execution boundary underneath, so tool calls still cross a policy gate and land in one evidence chain. We are designed to sit under things, including other runtimes.
Will AWS just ship the missing pieces?
Some of them, eventually. They will not ship cloud-agnostic, because that is against the business model, and a verifiable record the platform owner cannot rewrite is awkward for a platform owner to sell. Those two are where we intend to stay ahead.
Is Velone cheaper?
Not automatically. At low volume on an existing AWS commitment, AgentCore is usually cheaper. At scale, or in BYOC where you buy your own compute, we tend to come out ahead. We will model it honestly with your numbers rather than claim a percentage.
What about Azure AI Foundry and Google's agent platform?
The same argument applies with the cloud name changed. Each is strong inside its own estate and structurally unable to be neutral across estates.
keep reading
Ring 0
Already on AgentCore?
Tell us what it is not covering. If the answer is nothing, we will say so and leave you alone.