Building a Secure AI Assistant for Visual Effects Artists Using Amazon Bedrock

untold_studios · Media & Entertainment · 2025 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Secure creative-studio AI assistant

Untold Studios needed to give visual effects and animation artists a natural-language way to access internal resources, tools, workflows, and creative-generation capabilities without forcing context switches or compromising strict data-security requirements.

Constraints:

• Artists have diverse needs and varying technical experience
• The assistant must fit into existing Slack workflows
• Slack requires event acknowledgments in less than 3 seconds
• Access to tools and data sources must follow user roles and clearance levels
• The studio wanted managed services and pre-built connectors instead of custom vector infrastructure

Architecture

Untold Assistant is a Slack-integrated serverless AWS application using Amazon Bedrock with Claude 3.5 Sonnet, Stable Diffusion 3, and Bedrock knowledge-base connectors. API Gateway receives Slack events, a reserved-capacity Lambda acknowledges within Slack's 3-second window, a second Lambda performs longer processing, Bedrock handles NLP and function calling, RAG connectors reach Confluence, Salesforce, and S3-backed asset metadata, DynamoDB stores user mappings, memories, logs, and tool invocations, and CloudWatch plus Slack alerts monitor errors.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  artist[Artist] --> slack[Slack]
  slack[Slack] --> api-gateway[API Gateway]
  api-gateway[API Gateway] --> acknowledgment-lambda[Acknowledgment Lambda]
  acknowledgment-lambda[Acknowledgment Lambda] --> processing-lambda[Processing Lambda]
  processing-lambda[Processing Lambda] --> amazon-bedrock[Amazon Bedrock]
  amazon-bedrock[Amazon Bedrock] --> claude-3-5-sonnet[Claude 3.5 Sonnet]
  amazon-bedrock[Amazon Bedrock] --> stable-diffusion[Stable Diffusion]
  amazon-bedrock[Amazon Bedrock] --> rag-connectors[RAG Connectors]
  rag-connectors[RAG Connectors] --> internal-resources[Internal Resources]
  processing-lambda[Processing Lambda] --> dynamodb[DynamoDB]
  processing-lambda[Processing Lambda] --> cloudwatch[CloudWatch]

Components

Data flow

An artist sends a Slack DM or @mention. API Gateway receives the Slack event, the first Lambda quickly acknowledges with a gear emoji and forwards work to the second Lambda, Claude 3.5 Sonnet decides whether to answer directly or call a tool, role-restricted tools access Confluence, Salesforce, S3 asset metadata, image generation, or stored user preferences, and the assistant responds in Slack while logging queries and tool calls to DynamoDB.

Why this architecture

Untold used Slack to avoid context switching, Bedrock to keep data inside AWS while gaining Claude, Stable Diffusion, and managed RAG connectors, and a two-Lambda pattern to satisfy Slack's acknowledgment SLA without adding SNS/SQS latency. Role-restricted tools and DynamoDB-backed user mapping keep capabilities aligned with each artist's authority.

Models used: Anthropic Claude 3.5 Sonnet · Stable Diffusion 3 · Amazon Titan Text Embeddings

Scale

• Slack expects an acknowledgment in less than 3 seconds.
  “requirement. The incoming event from Slack is sent to an endpoint in API Gateway, and Slack expects a response in less than 3 seconds, otherwise the request fails. The first Lambda function, with reserved capacity, quickly acknowledges the event and forwards the request to the second”article, stated
• Untold Assistant handles up to 120 queries per day.
  “The Untold Assistant currently handles up to 120 queries per day, with about 10–20% of them calling additional tools, like image generation or knowledge base search.”article, stated
• About 10-20% of queries call additional tools.
  “The Untold Assistant currently handles up to 120 queries per day, with about 10–20% of them calling additional tools, like image generation or knowledge base search. Especially for new users who aren’t too familiar with internal workflows and applications yet, it can save a lot of time.”article, stated
• The assistant cuts retrieval time from minutes to seconds for some support questions.
  “Instead of searching in several different Confluence spaces and Slack channels or reaching out to the technology team, they can just ask the Untold Assistant, which acts as a virtual member of the support team. This can cut down the time from minutes to only a few seconds.”article, stated
• The planned clustering trigger is more than 10 similar questions from different users within a week.
  “similar questions. When the cluster frequency exceeds our defined threshold (for example, more than 10 similar questions from different users within a week), we enhance our knowledge base or update onboarding materials to address these common queries proactively, reducing repetitive questions”article, stated

Alternatives considered (roads not taken)

Build a custom frontend

Rejected because: Slack already provided the needed UI primitives and reduced context switching.

Insert SNS or SQS between the Slack acknowledgment and processing Lambda

Rejected because: Untold called the second function directly to keep latency low.

Use LangChain-style comprehensive function-calling frameworks

Rejected because: A lightweight custom function-calling approach kept footprint small and focused on the use case.

Build custom vector store and embedding pipelines

Rejected because: Bedrock connectors handled embeddings, vector storage, and search, reducing development time.

Patterns

tool-use-orchestration (agent-architecture)

Claude function calling converts natural-language artist requests into structured tool invocations.

rag-retrieval (retrieval)

Bedrock connectors provide RAG over Confluence, Salesforce, and S3-backed asset metadata.

safety-policy-enforcement (security)

Tool access is restricted by mapped user roles and clearance levels.

agent-memory (personalization)

The assistant stores user preferences and adds them to future request context.

observability-tracing (operations)

Queries and tool invocations are logged to DynamoDB and errors are monitored through CloudWatch and Slack notifications.

Tradeoffs

Use Slack as the assistant interface

Chose Slack built-in features over A custom frontend.

Rationale: Slack already had threads, reactions, file sharing, and daily artist usage, reducing friction and context switching.

Use Bedrock managed connectors

Chose Amazon Bedrock connectors and managed vector services over Custom vector store integrations and embedding pipelines.

Rationale: Managed connectors reduced development time and complexity while keeping data in AWS.

Keep function calling lightweight

Chose Custom single-pass function calling over Comprehensive framework-based function-calling loops.

Rationale: A smaller custom footprint was enough for the use case and kept the system robust.

Gotchas (what bit them)

Slack event handling has a hard acknowledgment window.

Root cause: Slack fails requests that are not acknowledged in under 3 seconds.

Resolution: Untold uses a two-Lambda path: one immediate acknowledgment function and one unrestricted processing function.

Natural-language access must still enforce authorization.

Root cause: Different artists have different roles and clearance levels for internal data and tools.

Resolution: Slack user IDs are mapped to internal users and tool access is restricted by role.

Function-calling loops can add complexity and risk.

Root cause: Agents can call functions repeatedly until success, but Untold wanted simple robust behavior.

Resolution: The implementation uses a single-pass function call.

Evaluation

Untold monitors performance and errors through CloudWatch, logs every query and tool invocation to DynamoDB, uses Slack reactions for immediate feedback, and plans clustering of saved queries to improve the knowledge base.

Metrics: up to 120 queries per day · 10-20% tool-call rate · minutes to seconds time reduction · more than 10 similar questions in a week threshold · CloudWatch performance and error states

Outcomes

• Untold Assistant handles up to 120 queries per day
• 10-20% of queries call additional tools such as image generation or knowledge base search
• Information retrieval time can drop from minutes to seconds
• Bedrock reduced development time from months to weeks

The system is available around the clock for artists and is built for rapid addition of new function calls such as render job error analysis.