Telephony‑First Voice Ordering: Build an AI Restaurant Host with Amazon Connect, Bedrock and AgentCore

Pick up the phone, and leave with a finished order

Dial a restaurant, hear a natural voice confirm your location, say what you want, and hang up with the order placed. No app, no login, no IVR tree. Amazon’s sample shows how to build that telephony‑first experience by combining Amazon Connect (telephony and Agentic Voice), an orchestration model running in Amazon Bedrock (Anthropic Claude Haiku 4.5), and a decoupled backend exposed as discoverable tools via an AgentCore Gateway using the Model Context Protocol (MCP).

“Your restaurant AI host is live at +1XXXXXXXXXX, dial to test.”

The deploy script prints the phone number to stdout when provisioning completes. The repository automates eight AWS CDK stacks that wire telephony, speech, the AI agent, and a sample backend together so you can test quickly.

Why this architecture matters

The design separates three responsibilities so you can iterate on each independently:

  • Telephony channel: Amazon Connect answers calls, runs contact flows, and owns phone numbers and queues.
  • Conversation orchestration: an Amazon Connect AI agent backed by Anthropic Claude Haiku 4.5 (via Amazon Bedrock) runs the dialogue, decides when to call backend tools, and enforces guardrails.
  • Business backend: API Gateway → Lambda → DynamoDB implements menus, carts, orders, and locations; AgentCore Gateway registers those REST endpoints as MCP tools the agent can call by name.

That separation lets you change menu logic, POS integrations, or compliance flows without rewriting the agent prompt or contact flow. The agent asks for a tool by name (PlaceOrder, MenuLookup, etc.). AgentCore Gateway maps that call to your REST API at runtime.

Core components that make it work

  • Amazon Connect + Agentic Voice: provides Advanced ASR with confidence‑based end‑of‑turn detection (shorter, smarter pauses) and expressive TTS for a conversational experience.
  • AgentCore Gateway (Bedrock AgentCore): reads your OpenAPI schema at deploy time and registers endpoints as named MCP tools, then forwards agent tool calls to API Gateway.
  • Amazon Connect AI agent (orchestration): runs the conversation and invokes tools; in the sample it uses Anthropic Claude Haiku 4.5 via Amazon Bedrock.
  • Backend services: Lambdas implement menu lookups, carts, order placement, and location logic. DynamoDB stores Customers, Orders, Menu, Carts, and Locations. Amazon Location Service supports geocoding and pickup recommendations.
  • Safety & monitoring: Amazon Connect AI Guardrails enforce content filters and denied topics, CloudWatch collects logs and metrics, and AWS KMS encrypts data at rest.

What the sample delivers, out of the box

git clone https://github.com/aws-samples/sample-restaurant-telephony-ai-host-using-amazon-connect-customer.git
cd sample-restaurant-telephony-ai-host-using-amazon-connect-customer
./scripts/deploy-all.sh –deploymentPrefix qsr-cn

  • Cleanup (destructive) that removes the eight CDK stacks:

./scripts/cleanup-all.sh –force –deploymentPrefix qsr-cn

Prerequisites: Node.js 18.x or later (24.x recommended), AWS CLI 2.x, git, an AWS account with Amazon Bedrock model access for Anthropic Claude Haiku 4.5 in the deployment Region, and an Amazon Connect phone number quota. The sample recommends starting in US East (N. Virginia), us-east-1.

Cost reality, one number and what it does (and doesn’t) include

The sample gives a useful reference: as of July 2026, running the solution with default settings in US East (N. Virginia) costs about $35 per month for 1, 000 voice orders that average five minutes each. Treat that as an illustrative aggregate. Your actual bill depends on multiple line items:

  • Amazon Connect per‑minute telephony charges (toll‑free vs local differ by region).
  • Bedrock model usage (Anthropic Claude Haiku 4.5) billed by model invocation and compute, with region and concurrency affecting cost.
  • Agentic Voice ASR/TTS usage inside Amazon Connect.
  • API Gateway, Lambda invocations, and DynamoDB storage, reads, and writes.
  • Phone number monthly charges, data transfer, and any third‑party payment processor fees (if used).

Use your account rate cards and typical call lengths and concurrency to build a per‑order cost. The repo’s $35 figure is a reasonable starting estimate but not a substitute for your own calculation.

Caller identity, privacy, and escalation

The contact flow captures the caller phone number and pushes it into the agent session so returning customers can be recognized without logins. If caller ID is blocked, the system creates an anonymous session ID. Phone number equals identifier, not proof of identity. Add a one‑time passcode (OTP) or other verification for sensitive actions like refunds or changing account details.

Contact flow outcomes are simple: Complete (order placed) or Escalate (ask for a person). By default the sample disconnects after either outcome, but you can route Escalate into a live Connect queue or agent workflow.

Guardrails, what they do, and what to tune

The sample attaches an Amazon Connect AI Guardrail to the agent. Guardrails filter categories like hate, insults, sexual content, violence, and prompt attacks, apply profanity lists, and include default denied topics such as political discussion and financial investment advice. Example guardrail output is:

“I am sorry, I can only help with restaurant orders, “

Guardrail behavior is configurable. The authors recommend tuning guardrail sensitivity against your real prompts and call transcripts to reduce false positives that block legitimate orders.

Example call (short, illustrative)

This is a concise, fictional transcript showing the flow and a backend tool call. It’s meant to illustrate the pattern, not verbatim model output.

Agent: “Welcome to Bay Street Pizza. Can I get your phone number to find your account?”
Caller: “It’s 555‑123‑1212.”
Agent: (passes number to session, calls MenuLookup → returns specials)
Agent: “We have a large pepperoni special for $14.50. Would you like that?”
Caller: “Yes, and make it extra cheese.”
Agent: (calls PlaceOrder with items and pickup location) → (Order returns confirmation #A273)
Agent: “Got it. Your order A273 will be ready for pickup in 20 minutes. Would you like to pay now?”
Caller: “No, I’ll pay at pickup.”
Agent: “Okay. Your order is placed. Goodbye.”

Two realistic failure modes, and how to mitigate them

  • ASR noise or misheard items: noisy background or accents cause wrong menu entries. Mitigation: confirm critical fields like item, size, and modifiers with a short recap. Implement confidence thresholds, and fall back to DTMF or human escalation when confidence is low.
  • Guardrail false positive blocks a valid request: over‑aggressive filters deny complex or unusual orders. Mitigation: log blocked cases for manual review, create explicit allow lists for restaurant‑specific words or menu items, and lower sensitivity only for verified production prompts.

Security, PCI, and compliance, concrete must‑dos

  • Do not record or store card numbers in plain logs. For voice payments, use a third‑party PCI‑compliant voice payments processor or redirect customers to a secure web payment flow.
  • Treat phone number as an identifier; require OTP for actions that need verified identity.
  • Harden JWTs: short TTLs, automated rotation (AWS Secrets Manager), signing keys in KMS, and explicit verification in the AgentCore Gateway. The sample uses a custom JWT authorization that validates tokens against the Amazon Connect instance, design key rotation and auditability for production.
  • Use least-privilege IAM roles for Lambda, API Gateway, and Bedrock. Enable CloudTrail with log integrity checks and centralize logs in CloudWatch or a SIEM.
  • Redact PII from logs and retain only what’s required for business needs. Consider AWS Macie and S3 object lock for retention controls and compliance.
  • Confirm regional data residency requirements and the availability of Bedrock models and Agentic Voice features in your target region before production rollout.

KPIs and telemetry to instrument from day one

  • End‑to‑end latency (median and 95th/99th percentile) per turn and per order.
  • Tool call success rate and error breakdown (API Gateway / Lambda / downstream POS).
  • Order accuracy rate (human‑audited sample vs agent order result).
  • Guardrail false positive rate and number of escalations per hour.
  • Cost per successful order and cost per model invocation.

Practical rollout checklist

  • Confirm Bedrock access for Anthropic Claude Haiku 4.5 in your target Region (the sample recommends us-east-1).
  • Bootstrap CDK in your account and region (example: npx cdk bootstrap aws://<ACCOUNT_ID>/<REGION>).
  • Clone the repo and run ./scripts/deploy-all.sh; watch stdout for the phone number printed on completion.
  • Test end‑to‑end with low volume, inspect CloudWatch logs for turn‑level traces and Guardrail decisions.
  • Load‑test Bedrock paths and AgentCore Gateway flows to measure tail latency and concurrency limits before scaling.
  • Tune guardrails and the agent prompts against real call transcripts to reduce false positives.
  • Design and validate a PCI approach for payments (voice PCI processors, web redirect, or in‑store payment only).
  • Implement secrets rotation, short JWT TTLs, least‑privilege IAM, and CloudTrail auditing.

Questions a curious reader will ask

  • How does the AI agent call my backend?

    • The AgentCore Gateway reads your OpenAPI schema at deploy time and registers endpoints as named MCP tools; when the agent calls a tool, the gateway forwards the request to API Gateway → Lambda so your backend handles business logic like MenuLookup and PlaceOrder.

  • Can callers be recognized without logins?

    • The contact flow captures and passes the caller phone number into the agent session; if caller ID is blocked the system creates an anonymous session ID. Use an OTP for verified identity when you need to authorize sensitive actions.

  • What about safety and off‑topic requests?

    • An Amazon Connect AI Guardrail filters categories (hate, sexual content, violence, prompt attacks), supports profanity lists, and denies certain topics by default; you should review and tune the guardrail settings for your use case so it doesn’t block valid orders.

  • How much does it cost to run?

    • As of July 2026, the sample estimates about $35 per month for 1, 000 five‑minute orders in US East (N. Virginia). That figure is an aggregate example, calculate your per‑service costs (Connect telephony, Bedrock model usage, ASR/TTS, API Gateway/Lambda/DynamoDB, phone numbers) against your call patterns for an accurate budget.

  • Is this production ready out of the box?

    • The sample is a production‑aligned blueprint that automates core wiring, but you must add hardened security (JWT rotation, least privilege), a PCI strategy for payments, regional availability checks, and load testing before a full production rollout.

Who should try this, and how to capture value fast

If your business still loses orders to long hold menus, busy lines, or customers who prefer speaking to tapping, this pattern is worth piloting. Start in a test account in us‑east‑1, run low‑volume trials, instrument the KPIs above, and iterate on prompts and guardrails. Add OTPs for identity, plan a PCI‑compliant payment path, and scale only after measuring latency and model concurrency under load.

Voice ordering won’t replace every channel, but when you keep the backend modular and instrumented, a phone call becomes a reliable conversion path, and your POS can change while the AI host keeps answering the phone.

1