Amazon Quick + NVIDIA NeMo for Supply-Chain Mitigation: Ranked, Evidence-Backed AI Agent Workflow

TL;DR

Turn supply‑chain alerts into ranked, evidence‑backed mitigation plans by pairing an Amazon Quick workspace (business UI and chat) with an NVIDIA NeMo Agent Toolkit workflow running behind AgentCore. The pattern separates a governed, lightweight front end from a testable, observable decision engine. The sample repo includes CloudFormation, scripts, sample data, and an eval harness. Teams can prototype quickly and then harden for production.

What this pattern wires together (high level)

  • Amazon Quick, the business‑user conversational workspace and front end for dashboards, knowledge access, chat agents, and MCP action triggers. Quick integrates dashboard visuals for planners and leaders.
  • Model Context Protocol (MCP), the protocol Quick uses to invoke external agentic actions.
  • AgentCore Gateway & Runtime (Amazon Bedrock AgentCore), the Gateway exposes MCP actions and forwards requests via a Lambda adapter to an AgentCore Runtime that hosts the NeMo container.
  • NVIDIA NeMo Agent Toolkit, the backend workflow orchestrator. NeMo runs registered tool functions, composes a mitigation plan, and emits evidence plus observability metadata such as traces, per‑step latency, and evaluator output.

Why this separation matters

Keep the planner UI stable and governed while the backend decision logic evolves on its own cadence. Operations teams can iterate on mitigation strategies, run automated evaluation, and capture traces and evidence before allowing automated writes into ERPs or WMSes.

Security first, read this before you deploy

“Important note: This sample deploys AgentCore Gateway with AuthorizerType=NONE, which performs no authentication or authorization. Use it only in a private, isolated demo environment with synthetic, non-sensitive data. Treat the endpoint as unauthenticated and accessible to anyone who obtains its URL. Never use this configuration in a shared, staging, or production environment. For non-demo deployment, configure a supported inbound authorizer, such as CUSTOM_JWT, and use Amazon Quick user or service OAuth authentication. For derived deployments, make authenticated access the default and require an explicit opt-in to enable AuthorizerType=NONE for private demo testing.”

Before you run the quickstart, open the CloudFormation parameters and be ready to change AuthorizerType from NONE to CUSTOM_JWT (OAuth/OIDC) for staging and production. Plan private networking for AgentCore Runtime, enable KMS encryption for S3 buckets that hold traces, and require human approvals for any writes to ERP or WMS systems.

Architecture (request path)

  1. Planner uses Amazon Quick (dashboard and chat) to investigate a disruption.
  2. Quick triggers an MCP action on the AgentCore Gateway.
  3. Gateway forwards the MCP call via a Lambda adapter to the AgentCore Runtime.
  4. The AgentCore Runtime runs a containerized NeMo Agent Toolkit workflow (FastAPI /invocations) that calls registered tools (PO risk, inventory exposure, etc.).
  5. NeMo returns a ranked mitigation plan plus evidence, per‑step traces, latency, and evaluator metadata back through the runtime and Gateway to Quick.

Developer quickstart (copy‑paste commands)

Clone the repo and enter the working folder:

git clone https://github.com/aws-samples/sample-amazon-quick-nvidia-nemo-agent-toolkit
cd amazon-quick-nemo-supply-chain-risk

Authenticate and confirm your identity:

aws configure sso
aws sso login –profile <your-profile-name>
export AWS_PROFILE=<your-profile-name>
aws sts get-caller-identity

Deploy (Mac/Linux example):

export AWS_REGION=us-east-1
export STACK_NAME=sc-risk-copilot-dev
./scripts/deploy.sh

Windows PowerShell equivalent:

$env:AWS_REGION=”us-east-1″
$env:STACK_NAME=”sc-risk-copilot-dev”
.\scripts\deploy.ps1

Inspect, evaluate, and clean up:

./scripts/inspect-runtime.sh (with AWS_REGION and STACK_NAME exported)
PYTHON_CMD=python3.12 ./scripts/eval-nemo-local.sh
./scripts/cleanup.sh (or .\scripts\cleanup.ps1)

Note: the sample uses AWS CodeBuild to build and push the container image, so Docker isn’t required locally.

Files and demo outputs you’ll see

  • outputs/quick-setup.txt, Quick setup values written by deployment.
  • amazon-quick-nemo-supply-chain-risk/sample-data/quick/supply_chain_risk_view.csv, recommended front‑end dataset for Quick.
  • outputs/runtime-response.json and outputs/runtime-summary.txt, runtime inspect artifacts with traces and timing.
  • outputs/local-eval-report.json, results from the local eval harness.
  • sample-data/eval/supply_chain_eval.jsonl, evaluation dataset the demo uses for regression checks.

How the NeMo workflow is organized

The sample registers a set of tool functions and wires them into a YAML workflow whose entrypoint is supply_chain_risk_orchestrator. Registered functions in the sample include:

  • po_risk_tool
  • inventory_exposure_tool
  • customer_impact_tool
  • contract_policy_tool
  • logistics_options_tool
  • mitigation_recommendation_tool

The orchestrator composes a ranked mitigation plan and returns evidence plus observability artifacts, including per‑step traces, timing and latency, and evaluator metadata captured by NeMo’s eval harness.

Example runtime timing (demo visualization)

In an example demo visualization the NeMo Agent Toolkit workflow completed end‑to‑end in 657 ms. Two steps dominated that run: PO risk lookup (267 ms) and contract policy retrieval (196 ms), which together accounted for over 70 percent of the measured latency in that sample invocation. Treat these as example tuning targets rather than production SLAs. Latency will vary by infrastructure, network locality, model cold/warm starts, and backend connector performance.

What the deployment creates

  • AWS CloudFormation stack that provisions the sample infra.
  • Amazon S3 buckets for sample datasets and knowledge docs.
  • An Amazon ECR repository for the backend image and an AWS CodeBuild project to build and push that image.
  • AgentCore Runtime update and an AgentCore Gateway MCP Lambda target.
  • Quick setup values written to outputs/quick-setup.txt.

Try the Quick workflow and chat prompts (copy‑paste)

Dashboard-generation prompt (use verbatim):

“Create an executive supply-chain risk dashboard for supplier delays and stockout risk. Include visuals for late purchase orders by supplier, revenue at risk by customer priority, high-risk SKUs by distribution center, days of supply by SKU, mitigation type, approval required, and supplier on-time rate. Add filters for supplier, SKU, risk level, and distribution center. Organize the dashboard for a supply-chain leader who needs to know what is at risk and where to act first.”

Sample chat prompts used for testing (use exactly to reproduce behavior):

  • “Which suppliers have the most delayed purchase orders and highest revenue at risk?”
  • “What does Supplier A’s delay notice say, and what does the logistics approval policy say about emergency air freight?”
  • “Supplier A delayed the July inbound shipment. Which customer orders are at risk and what should we do?”

Short summary for the Quick chat agent (use verbatim):

“Create a supply-chain risk assistant for planners and operations leaders. The assistant helps users understand supplier delays, inventory exposure, customer orders at risk, revenue impact, mitigation options, and required approvals. Connect it to the Supply Chain Risk Overview dashboard, the Amazon Quick S3 knowledge source for supplier notices and policies, and the supply-chain risk investigation MCP action powered by NVIDIA NeMo Agent Toolkit. Use the dashboard and knowledge source for diagnostic questions. Use the NeMo action when the user asks what to do next, which customer orders are at risk, what mitigation to take, or what approvals are required.”

In the sample NeMo-backed Scenario for “Supplier A, ” the orchestrator aggregates three risk items and suggested actions: SKU-1044 (high risk; partial air freight and finance approval), SKU-8831 (high risk; inventory transfer and operations approval), and SKU-7177 (medium risk; monitor-and-recheck).

Top three priorities after you validate the demo

  1. Harden access and network boundaries. Change AuthorizerType from NONE to CUSTOM_JWT (OAuth/OIDC), place AgentCore Runtime in private subnets, tighten security groups, and enable KMS for S3 buckets that store traces and eval artifacts.
  2. Replace CSV mocks with governed APIs. Swap sample CSV readers for authenticated, audited APIs such as Athena, RDS, or vendor ERP/WMS/TMS endpoints. Ensure reads are parameterized and writes are idempotent and require explicit human approvals in the Quick workflow.
  3. Make evaluation and observability part of CI. Keep the eval dataset (sample-data/eval/supply_chain_eval.jsonl) and the eval harness in CI so every workflow change runs regression tests. Store per‑step traces, latencies, and evaluator outputs in encrypted, access‑controlled buckets and wire alerts for drift or failures.

Production checklist

  • Inbound authorizer: set AuthorizerType=CUSTOM_JWT and bind to your identity provider (OAuth/OIDC).
  • API connectors: replace CSV reads with governed ERP/WMS/TMS REST endpoints. Implement idempotency and audit logs.
  • Trace governance: KMS encryption, S3 bucket policies, retention rules, and masking for PII.
  • CI/CD: image build, scan, sign, and canary deployments for workflow YAML and runtime containers.
  • Observability: capture per-step traces and latencies, integrate with CloudWatch/X-Ray, and keep evaluator pass rates in dashboards.
  • Human controls: require explicit approvals for writes and store approval events in audit logs.

Key questions (short, honest answers)

  • How do I get the sample running quickly?

    Clone the GitHub repo (git clone https://github.com/aws-samples/sample-amazon-quick-nvidia-nemo-agent-toolkit), follow the AWS SSO steps (aws configure sso, aws sso login –profile <your-profile-name>), set AWS_REGION and STACK_NAME, then run ./scripts/deploy.sh (or the PowerShell alternative).

  • Where does the backend logic live and how is it invoked?

    The AgentCore Runtime hosts a container with a NeMo Agent Toolkit workflow (FastAPI /invocations). Amazon Quick triggers an MCP action on the AgentCore Gateway (Lambda adapter), which forwards the call to the runtime. The workflow entrypoint is supply_chain_risk_orchestrator, which invokes registered tools to build a mitigation plan.

  • What observability and test artifacts does the sample produce?

    Inspect outputs/runtime-response.json and outputs/runtime-summary.txt for runtime traces and timing; run the eval harness to generate outputs/local-eval-report.json using sample-data/eval/supply_chain_eval.jsonl.

  • Is this sample safe to run in production as‑is?

    No. The Gateway is deployed with AuthorizerType=NONE for demo convenience. The sample explicitly warns against using that in shared or production environments and recommends CUSTOM_JWT (OAuth) and additional hardening steps.

  • Can I avoid installing Docker locally?

    Yes. The sample uses AWS CodeBuild to build and push the container image, so local Docker is not required for the default deployment path.

Final practical advice

Start with the sample to validate the planner experience and the NeMo orchestration pattern. Treat the demo as a developer sandbox: expose the decision evidence, wire evaluator tests into CI, and instrument per‑step traces before you allow automated writes. Then prioritize security, data, and quality. Swap AuthorizerType, move runtimes into private networks, enable KMS, replace CSVs with governed APIs and idempotent writes, and keep the eval harness in CI with telemetry dashboards. Do that and the pattern moves from a clever demo to an operational tool planners can trust.

2