Serverless end to end; the LLM is quarantined to narration. Numbers come only from the deterministic calc engine, grounding comes only from retrieval, and the FMC Act advice boundary is enforced by Bedrock Guardrails — before and after the model runs.
Why three separate boxes on the rightThe copilot's answer is assembled, not generated: the calc engine produces the numbers, Knowledge Bases produce the context, and Bedrock only writes prose over both. A hallucinated figure has no path to the member.
Guardrails are the compliance layerBedrock Guardrails run before and after the model: fund-switch recommendations are blocked as a topic policy and rerouted to the adviser handoff. The FMC Act boundary is infrastructure, not a prompt.
Proactive, not reactiveEventBridge watches unit-price movements; a drawdown past a member-relevant threshold triggers the intercept push — the copilot explains the fall before the member discovers the red number.
This prototype vs productionThe demo you just used mirrors this shape at hackathon scale: the deterministic engine runs in-page, and free-typed chat goes through a serverless function to a hosted LLM with the same advice-boundary system policy — swap that function's target to Bedrock and the architecture above is the production build.