Building a Secure Enterprise AI Assistant with Amazon Bedrock for Financial Services

payu · Finance · 2025 · source Agentic: yes · promotional bias: high · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Regulated financial-services enterprise AI assistant

PayU wanted employees to use generative AI for troubleshooting, drafting, HR policy questions, and business analytics without sending regulated financial data, customer details, or proprietary systems information through unsecured public AI tools.

Constraints:

• PayU is a Central Bank-regulated financial institution in India
• Data had to remain within India and inside PayU's VPC
• Different employee roles needed different agents, models, and knowledge bases
• The assistant needed to support both document RAG and business data queries
• Generated responses and prompts could contain sensitive organizational data
• Compliance required auditability for usage, configurations, and conversation history

Architecture

PayU built a private enterprise AI assistant around Open WebUI, an Access Gateway, Amazon Bedrock, Bedrock Agents, Bedrock Knowledge Bases, Guardrails, AWS PrivateLink, and PayU's Luna data lakehouse. Employees authenticate through SSO and RBAC into Open WebUI, choose foundation models or specialized agents, and route requests through the gateway to Bedrock. RAG uses S3-hosted documents, Bedrock Knowledge Bases, OpenSearch vectors, and Guardrails; text-to-SQL agents use schemas, action groups, Lambda, Athena, Glue, and S3 datamarts.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  employee[Employee] --> open-webui[Open WebUI]
  open-webui[Open WebUI] --> access-gateway[Access Gateway]
  open-webui[Open WebUI] --> amazon-rds-postgresql[Amazon RDS PostgreSQL]
  access-gateway[Access Gateway] --> amazon-bedrock[Amazon Bedrock]
  amazon-bedrock[Amazon Bedrock] --> bedrock-agents[Bedrock Agents]
  amazon-bedrock[Amazon Bedrock] --> bedrock-knowledge-bases[Bedrock Knowledge Bases]
  amazon-bedrock[Amazon Bedrock] --> bedrock-guardrails[Bedrock Guardrails]
  amazon-bedrock[Amazon Bedrock] --> privatelink[PrivateLink]
  bedrock-agents[Bedrock Agents] --> action-groups[Action Groups]
  action-groups[Action Groups] --> aws-lambda[AWS Lambda]
  aws-lambda[AWS Lambda] --> amazon-athena[Amazon Athena]
  amazon-athena[Amazon Athena] --> luna-data-lakehouse[Luna Data Lakehouse]
  bedrock-agents[Bedrock Agents] --> bedrock-knowledge-bases[Bedrock Knowledge Bases]
  bedrock-knowledge-bases[Bedrock Knowledge Bases] --> opensearch-service[OpenSearch Service]

Components

Data flow

An employee signs in to Open WebUI through the identity provider and receives role-scoped access to models, agents, knowledge bases, and foundation models. The Access Gateway translates frontend requests to Bedrock-compatible calls. For HR policy questions, Bedrock Knowledge Bases retrieve vectorized S3 documents from OpenSearch. For business analytics, a Bedrock agent orchestrates text-to-SQL, validates syntax, invokes action groups, runs Lambda/Athena against S3 datamarts, and returns governed answers over PrivateLink.

Why this architecture

PayU chose a managed-private AWS architecture because it needed enterprise GenAI access without violating data-residency, VPC, and audit constraints. Open WebUI gave a controllable self-hosted interface; Bedrock supplied model, agent, knowledge-base, and guardrail services through one API; PrivateLink avoided public internet exposure; and specialized agents matched different retrieval patterns to HR documents and lakehouse analytics.

Models used: Amazon Bedrock foundation models · AI21 Labs models · Anthropic models · Cohere models · DeepSeek models · Meta models · Mistral AI models · Amazon models

Scale

• PayU operates as a Central Bank-regulated financial institution in India.
  “As a Central Bank-regulated financial institution in India, we recently observed a surge in our employees’ interest in using public generative AI assistants.”article, stated
• The system serves merchants, banks, and consumers through PayU's full-stack digital financial services system.
  “offers a full-stack digital financial services system that serves the financial needs of merchants, banks, and consumers through technology.”article, stated
• PayU deployed at least four named specialized agents for business functions.
  “we deployed specialized agents tailored to specific business functions—including hr-policy-agent, credit-disbursal-agent, collections-agent, and payments-demographics-agent.”article, stated
• The business analyst team reported a 30% productivity improvement after rollout.
  “After the rollout, internal estimates revealed a 30% improvement in the productivity of the business analyst team.”article, stated

Alternatives considered (roads not taken)

Allow employees to keep using public generative AI assistants

Rejected because: Public tools risked transmitting proprietary, customer, and regulated data to third-party AI providers.

Use a single general-purpose assistant for every business function

Rejected because: PayU needed role-governed agents tied to specific job functions, data sources, and retrieval mechanisms.

Expose Amazon Bedrock over public internet or NAT paths

Rejected because: Organizational prompts and responses could contain sensitive data, so PayU used PrivateLink to keep connectivity inside AWS private networking.

Patterns

multi-agent-orchestration (agent architecture)

PayU deployed role-specific Bedrock agents for HR policy, credit disbursal, collections, and payments demographics instead of one broad assistant.

rag-retrieval (retrieval)

The HR policy agent queries vectorized S3 documents stored in OpenSearch through Bedrock Knowledge Bases.

tool-use-orchestration (agent architecture)

Text-to-SQL agents use Bedrock orchestration, action groups, schemas, Lambda, and Athena to execute structured data queries.

privacy-preserving-processing (security)

PayU used AWS PrivateLink and VPC-contained access so prompt context and generated responses stayed off the public internet.

guardrails-io-filtering (safety)

Amazon Bedrock Guardrails filters harmful content and hallucinated responses across RAG and agent workflows.

Tradeoffs

Use Open WebUI as the employee frontend

Chose A self-hosted open-source UI with enterprise features over Building a custom assistant frontend from scratch.

Rationale: Open WebUI already provided extensibility, SSO, RBAC, and model integration while remaining deployable inside PayU's private environment.

Use Bedrock managed services

Chose Amazon Bedrock foundation models, agents, knowledge bases, and guardrails over A single in-house LLM service and orchestration stack.

Rationale: Bedrock gave PayU a unified API plus managed agent, RAG, and guardrail features aligned with its enterprise requirements.

Separate HR policy RAG from business analytics text-to-SQL

Chose Use-case-specific agents and retrieval paths over One generic retrieval mechanism for all enterprise questions.

Rationale: Documents benefited from vector search, while business datamarts required SQL execution over lakehouse tables.

Gotchas (what bit them)

Public AI assistants created immediate regulatory and data-leak risk.

Root cause: Employees found public tools useful enough to use them for work, but the tools could receive sensitive system, customer, and regulated data.

Resolution: PayU restricted public tools and built a private Bedrock-based assistant with VPC, RBAC, and data-residency controls.

Different data types required different retrieval and generation paths.

Root cause: HR documents and business datamarts could not be served well by the same retrieval mechanism.

Resolution: PayU combined RAG over vectorized documents with text-to-SQL over S3 lakehouse data.

Agent execution needed explicit serverless permissions and resource policies.

Root cause: Action groups invoke compute against Athena and S3-backed data, so insecure Lambda permissions could undermine the platform.

Resolution: The architecture calls out configuring resource policies and permissions for secure Lambda operation.

Evaluation

The source reports rollout impact through internal productivity estimates, generated organizational interest, business-unit collaboration, and reduced analyst turnaround time.

Metrics: 30% business analyst productivity improvement · reduced turnaround times · multiple workflows added after rollout

Outcomes

• PayU deployed a private AI assistant for employees under VPC and role-based controls
• The system supports specialized agents for HR policies, credit disbursal, collections, and payments demographics
• PayU reports a 30% productivity improvement for the business analyst team
• Business units and technical teams increased collaboration around generative AI workflows

The implementation serves a regulated Indian financial-services environment with multiple specialized agents, SSO/RBAC, PrivateLink connectivity, and S3 lakehouse analytics.