This was one of the best sessions at Infor Velocity Week, and it had a full house. I wish the room had been Conway at the Rosen Shingle Creek. The presenters were enthusiastic and passionate about the topic. The set that explained how the stack fits together, and the AWS Bedrock role in it, was especially good. I complimented both of them on explaining complex concepts in a simple way.
Natalia Ptaszek, director of product management for the AI pillar on the Infor Industry Cloud Platform, took the Infor layers. Deepak Kovvuri, senior solutions architect at Amazon Web Services, took the Amazon layer under them. The session was AI That Acts: Intelligent Automation with Infor and AWS. Ptaszek has been at Infor about ten years. She started on Coleman AI, the product customers now know as Infor AI, then moved to robotic process automation. She now covers Infor AI, the generative AI platform, and Infor Orchestrator, which runs agents, robotic flows, and machine learning models on one path. Kovvuri has been at AWS about nine years and has worked with the Infor engineering teams on these builds.
Instead of recreation, Infor chose to double down on AWS Bedrock's existing functionality. No matter how models change, or how many new models get introduced, Infor is not scrambling to make changes. Bedrock finds the right model for the job, so no one is using a sledgehammer to nail something. The guardrails that already exist in Bedrock are useful, and they do not need duplication from Infor.
Bedrock holds the model and checks the prompt
This is the AWS role in the stack. Bedrock hosts the model Infor calls, and Bedrock Guardrails sit on the way in and the way out. Infor does not train its own large language model.
Kovvuri defined an agent as four parts before he named a product.
- The brain is a large language model.
- Context is the documents, the knowledge base, and the structured data.
- Memory is what the agent keeps from earlier turns with that user.
- Tools are how it reads or writes.
Those agents need a production place to run. That place is Amazon Bedrock AgentCore: a sealed run, a memory, a door to the customer's systems, and a scratch space. Each signed-in user gets a session, and a follow-up stays in that session.
Bedrock is the switch. The slide listed leading providers, evaluation tools, a customer's own models, and the Bedrock Marketplace. Claude, an OpenAI model, or a model the customer brings can be reached from the same place. A task does not have one permanent model. Evaluate the model against the job, then move. Infor's supervisor agent runs on Claude Sonnet 4.6. Ptaszek said the team is most likely using Haiku 4.5 where an agent has to read Swagger documentation for an endpoint, because that model has done better at reading the API file. Those picks follow a conversation with AWS when a new model lands.
A prompt is inspected before the model sees it. The answer is inspected before the user sees it. The slide listed what the gate covers.
- Harmful content.
- Attempts to talk the agent out of its instructions.
- Topics the customer declares off limits.
- Personal information removed before it reaches the model.
- Answers checked against a written policy.
- Answers that drift past the source they were given.
- Words the customer never wants used.
The same guardrail works with agents, knowledge bases, and models inside or outside Bedrock. Ptaszek said the embedded screens use those Bedrock guardrails. She sent a prompt about trading on confidential merger news. The call was blocked for a policy violation, and the response showed the guardrail had fired.
The model is copied into an account AWS controls. The company that built the model cannot reach the questions, the answers, or the logs. AWS calls the operator rule zero operator access. An engineer cannot open the session. If a support ticket needs a look, the customer sends a screenshot. Prompts are not kept, and they are not sent back to train a vendor model. Ptaszek said the same holds for the Infor experiences that call Bedrock. Customer data is not used to fine-tune a model, train a new one, or share with another customer. Bedrock runs in the customer's region, so a European customer reaches the European service and a United States customer reaches the United States service. Anonymized conversation history for troubleshooting sits in LangSmith for 14 days, after Amazon Comprehend strips personal data. She pointed people to an Infor Industry AI transparency note on the Infor site.
The platform holds the applications and the data
This is the Infor layer the agent calls. The applications and the records live here. Bedrock does not replace them.
The Industry Cloud Platform slide put industry ERP and applications on the bottom row. Above that row sit federated security, the API gateway, the process modeler, workflow, and the portal. The data fabric sits above those doors: streaming, a data lake, a data warehouse, governance, risk, and compliance, master data management, and a knowledge graph.
The keynote architecture slide uses the same order with different names.
- Amazon Bedrock is the lowest bar.
- The Infor Industry Cloud Platform interoperability layer is the next bar.
- Governance, risk, and compliance sits on that.
- Four boxes sit on top: Industry Foundation, Agent Intelligence, Enterprise Orchestration, and Interaction Layer.
The assistant plans, the tool posts
This is how a question becomes a transaction. The supervisor decides. A role agent does the work. The tool is an application programming interface the signed-in user could already call.
Ptaszek put three threads on the generative platform.
- Embedded experience sits on a screen the user already has. In M3, a widget drafts an item description. In LN, one click builds a project summary. In CSD, a product description becomes product attributes.
- The GenAI Assistant is the conversation. Its supervisor agent plans the work and does not perform the transaction. Role-based industry agents do that.
- The knowledge hub feeds both. A public hub answers from Infor guides, including how to set up a customer order in M3. A second hub reads the customer's own files in Infor Document Management.
Kovvuri used a buyer named Dana. She asks an agent to approve a $50,000 purchase order. The agent takes Dana's policies and permissions. Ptaszek's example was a delivery date moved to the best available one. If that user can change delivery dates, the assistant can. If the user cannot, the assistant says it cannot do the job on that person's behalf.
She called the move onto AgentCore a roadmap item, and offered the code interpreter as a look at work that is not released yet. Agents write and run Python, JavaScript, or TypeScript in a managed sandbox, then answer from the result of that run. She showed a sales report and asked for margin, revenue, and cost. The totals came from the function running behind the assistant. She said she would not trust the same ask if the model were adding the rows itself.
The rule book sits above the record
This is the check that comes after the guardrail. A safe prompt can still post the wrong unit. Infor IQ is the context the agent reads before the tool writes.
Kovvuri put five questions on one slide, each aimed at a different owner.
- Where does our data go? Compliance and legal.
- What is an agent allowed to say to a customer? Whoever owns the brand.
- Where does an agent run, and who else is in there? IT.
- What is an agent allowed to do once inside? Process owners and audit.
- How do I know an agent is right? The people who have to use it.
The slide said the first four are about safety and the fifth is about being right. Purchase order 4521 had a line, C301, for 50 cases at $4.82. The unit should have been eaches. The caption said the line was perfectly authorized and perfectly polite, and wrong.
The knowledge graph is the building: purchase order 4521, lot NH-6061 inside 70 pumps, Nordhaven's 136 lines, forty thousand parts. The ontology is the blueprint: an order has a customer, a controlled part needs screening, header then lines then confirm. Infor IQ holds the shared names, the structural model, and the step that sends the request to the right agent. Ptaszek said that model is tailored to a micro-vertical.
Kovvuri then showed a reference pattern built with manufacturers. He said it was not an Infor product. Eight systems across three plants. A question about which line had the most scrap this week came back as Cedar Rapids Line 1, 2,260 units, with each figure cited to the system it came from. Asked about employee turnover, the pattern said none of the connected systems held HR data, and it did not invent a number.
Ptaszek closed on the industry AI architecture from the keynotes. Industry agents cover a function inside an application. Model Context Protocol, the Anthropic standard she compared to a plug for applications, is how those tools can also be called from assistants outside the GenAI Assistant. The orchestrator sits above the industry agents and is meant to run a process across the applications inside a CloudSuite. The assistant is the screen today. She also described headless runs that call a person in only when the job needs one, with output aimed at workspaces, Microsoft Copilot, and Amazon Quick. AI Studio is the path where a written process builds the flow. Recording, monitoring, and guardrail hits sit in governance, risk, and compliance. The layer under that picture is Amazon Bedrock.
Ask which Bedrock model is assigned to which job, and who reviews that assignment when a new model lands.
Ask for one blocked prompt from the Bedrock guardrail log, so the gate in use is the one already on Bedrock.
Ask which region the GenAI Assistant calls, and whether the LangSmith copy is still limited to 14 days after Comprehend removes personal data.
This session was the same day as the note on starting with the process. That note named the suite. This hour named the layers, and the Bedrock role under them.
