AI Agents

Circle K cuts incident triage to under 15 minutes with Amazon Bedrock agents

Emerge Times

Circle K, the convenience and fuel retailer, has built an automated incident-triage system on Amazon Bedrock. An AWS blog post dated 2 November 2026, co-written with a Circle K DevOps engineer, says mean triage time is now under 15 minutes. The team’s internal metrics show a 67–75 percent reduction from the earlier 45–60 minutes. The company deployed the current version, which runs on Amazon Bedrock AgentCore, in April 2026.

The problem and the first design

Circle K runs more than 17,200 stores in 27 countries. Its point-of-sale, loyalty and EV charging applications run on AWS. Its DevOps team watches multiple AWS accounts through Grafana. For each alert, engineers checked logs in Amazon CloudWatch, traces in Amazon OpenSearch Service and task status in Amazon ECS. They also cross-referenced runbooks in GitHub. The team saw two weaknesses: the same lookups were repeated for every incident, and the quality of triage depended on how well the on-call engineer knew the affected service.

The team considered open source agent frameworks on self-managed infrastructure. By the post’s account, that path would have left the team responsible for hosting models, versioning prompts, orchestrating tools and securing the stack. It chose Bedrock, which fit its existing IAM, VPC and logging setup. The post also states that AWS does not pass customer data to model providers and does not train foundation models on it.

The first version used Amazon Bedrock Flows. A Grafana alert went through Amazon SNS and SQS to a Lambda function, which started the Flow. Two agents ran in parallel. One inspected AWS resources. The other queried OpenSearch and was the only one with access to a knowledge base of service “product cards”. A third agent then searched GitHub repositories using the first two agents’ findings. A final model call with no tools produced a structured summary covering probable root cause, evidence, owner and remediation steps. Lambda posted it to Slack, typically within 5–15 minutes.

Migration to AgentCore

The Flows design worked for months, and simple incidents finished in under 10 minutes. Data volumes and investigation context then grew, and some analyses needed more time than a single Flow node allowed. Filtering logs harder, shortening context and splitting services across Flows helped only partly.

The team containerized its agent logic and moved it to AgentCore Runtime. The three agents became one agent running in a single session. The post says Runtime supports sessions of up to 8 hours, far more than current investigations need. AgentCore Gateway exposes OpenSearch, the knowledge bases and GitHub as tools, which centralizes access control. The post also credits session persistence, OpenTelemetry-based observability through CloudWatch, and framework flexibility. The agent still returns results to Lambda within 15 minutes.

Reported results, all from Circle K’s internal metrics, are:

  • Simple incidents get a summary within 5 to 8 minutes.
  • Complex incidents spanning several services, previously over an hour by hand, finish within 15 minutes.
  • Every on-call engineer gets the same structured summary, which also helps escalation and the dismissal of false alarms.

Why it matters for agents

The case shows a common production trade-off in agent design. Splitting work across specialized agents keeps each context window manageable. As data grew, though, the orchestration limits of the workflow tool became the bottleneck. Circle K consolidated into one longer-running agent with persistent state and tool access through a gateway. Other teams may see a similar pattern, but the post does not show that it holds generally.

The figures come from the team’s own measurements and are published by AWS, the vendor. The post does not describe how accuracy of root-cause findings was measured, so the time savings should not be read as proof of correct diagnoses. The system also produces recommendations for engineers rather than making fixes. The source describes the aim as supporting operational judgment, not replacing it.

Sources

This article was prepared with AI assistance and reviewed by an Emerge Times editor before publication. Licensed CC BY 4.0: credit “Emerge Times (emergetimes.com)”. Usage & License