MRH Trowe 如何在金融服务业实现安全的自助式 AI Agent

对于需要安全、自助式 AI Agent 的金融服务机构而言，基础 AI 聊天功能并不足够。在金融服务业，员工需要能够处理内部系统和敏感客户数据的 AI；该 AI 必须运行在受治理的环境中，并保持可审计性和成本透明度。这一切还必须在不要求每个团队各自搭建工具的情况下实现。

本文介绍了德国领先的商业及工业保险经纪商之一 MRH Trowe 如何为约 400 名员工提供安全的自助式 AI Agent 访问能力。该部署在正式投产的第一个月便达到了这一规模。该框架结合 Strands Agents、Amazon Bedrock AgentCore 和 LibreChat，提供德国金融行业所需的安全性、数据驻留和合规控制。首月生产成本约为每席位 14 美元；通过资源规格优化和定时扩缩容，基础设施成本有望进一步降低约 40%。

关于 MRH Trowe

MRH Trowe 是一家所有者经营的商业及工业保险经纪商，业务主要覆盖德国、瑞士和奥地利。MRH Trowe 通过自然增长和收购持续扩张，是最早采用完全基于云的 IT 基础设施的德国保险经纪商之一。AWS 是这一战略的首选合作伙伴，而 AI 的应用则是公司的战略目标，尤其用于简化内部流程并提升效率。

挑战：在不失去控制的前提下实现自助式 AI

作为高度受监管行业中的商业保险经纪商，MRH Trowe 观察到各业务部门员工对在日常工作中使用生成式 AI 的需求持续增长。各个团队开始自行试验 AI，这带来了工具碎片化、缺乏管理以及敏感客户和保险数据可能泄露的风险。

MRH Trowe 需要一种方式，使员工无需深厚技术技能即可快速自行构建和使用 AI Agent。同时，所有活动都必须保留在一个安全、集中治理的环境中，以满足金融行业的数据保护和合规要求。核心矛盾十分明确：既要实现广泛、自助式的 AI 访问，又要维持组织所需的安全性、控制力和成本透明度。MRH Trowe 的愿景是：“每个问题都应在人工介入前首先由 AI 回答，而重复性流程应由过去执行这些流程的人实现自动化。”

基础聊天界面无法满足业务所需的若干能力：

1. 上下文相关的响应——基于内部数据提供回答，而非仅依赖通用模型知识。
2. 多步骤工作流——需要收集信息、进行推理并跨多个步骤采取行动的任务。
3. 机构数据集成——与内部系统和文档存储库建立安全连接。
4. 集中治理——通过单一且受治理的应用程序，取代分散在各团队中的影子 AI 工具。

构建模块

该解决方案整合了三项技术，每项技术分别解决挑战中的特定部分。

Strands Agents

MRH Trowe 的开发人员使用 Strands Agents，这是一款开源 SDK，只需几行代码即可创建 Agent。Strands 负责处理编排和推理等 Agent 模式，并可从开发人员的笔记本电脑扩展到生产环境，使团队能够专注于使用场景而非基础设施。

Amazon Bedrock AgentCore

为在生产环境中运行 Agent，MRH Trowe 使用 Amazon Bedrock AgentCore 作为一个能够以任意框架或模型大规模构建、连接和优化 Agent 的平台。AgentCore 是 MRH Trowe 做出选择的决定性因素：它原生支持 Strands Agents 等开源框架，在计算和文件系统层面隔离每个 Agent 会话，并提供按使用量计费的模式，使团队能够随着采用规模扩大而保持成本透明度。这意味着团队能够保留 Strands 的灵活性，同时不牺牲受监管保险经纪商所需的安全性和会话隔离能力。

LibreChat

LibreChat 是商业 AI 聊天界面的开源替代方案。它为 MRH Trowe 提供了熟悉且可品牌化的聊天体验，有助于快速推广，同时也具备受监管组织所需的控制能力：

1. 用户管理——通过强大的身份验证和授权，在整个员工群体中按适当权限管理访问。
2. Token 预算——LibreChat 内置的 Token 预算系统可避免意外成本。
3. 多模型支持——可根据不同使用场景灵活选择最适合的模型，同时避免供应商锁定。
4. 对话管理——员工可以整理自己的 AI 交互，从而形成结构化环境。
5. 可自定义界面——可进行品牌化配置，以匹配 MRH Trowe 的企业形象。

实际应用：几分钟内将 Microsoft Teams 会议转化为结构化会议纪要

MRH Trowe 首个投入生产的 Agent，可将 Microsoft Teams 会议转换为可直接使用的会议纪要。在 LibreChat 中，员工可用德语请求查找一场与指定参与者进行的近期会议。该 Agent 会在员工日历中找到会议、获取转录文本，并生成包含日期、参与者、议程、讨论主题和行动项的结构化会议摘要。每次通话后的手动记录工作，变成了一条简单的请求。

两项设计选择使其能够安全用于受监管的保险经纪商。第一，每个请求均以已登录员工的身份运行。LibreChat 通过 Microsoft Entra ID 进行身份验证，并在服务器端将用户身份传递给 Agent，因此 Agent 只能访问该员工本人的日历和转录文本。用户身份无法从聊天框中自行设定。第二，处理过程保持在区域内：Agent、模型和数据均运行在 AWS 欧洲（法兰克福）区域，确保客户及会议数据留在德国。Amazon Bedrock AgentCore 和本解决方案使用的基础模型均可在欧洲（法兰克福）区域（eu-central-1）使用。服务和模型可用性因 AWS 区域而异。

解决方案架构

该解决方案部署在虚拟私有云（VPC）内的单个 AWS 账户中，员工通过企业网络连接。下图展示了解决方案架构，包括本节所述的连接、应用、数据和 Agent 层。

图 1：涵盖连接、应用、数据和 Agent 层的解决方案架构

主要组件包括：

1. 安全连接——员工可通过 Transit Gateway 实现与零信任提供商的组合，从任何地点访问系统；流量通过私有专用连接而非公共互联网传输。内部 Application Load Balancer（ALB）将请求路由至应用层。

以下网络视图进一步展开安全连接路径，展示本地用户如何通过 AWS 网络账户连接至应用账户私有子网中的内部负载均衡器。

图 2：本地用户经由 AWS 网络账户到达内部负载均衡器的网络路径

2. 应用层（LibreChat）——聊天体验以容器化服务的形式运行在 Amazon Elastic Container Service（Amazon ECS）上，并以 AWS Fargate 作为启动类型。其中包括 LibreChat 服务、检索增强生成（RAG）API 服务，以及用于快速文本搜索且无需将数据向量化的 MeiliSearch 服务。
3. 数据层。
   • Amazon DocumentDB（兼容 MongoDB）用于存储用户、会话和对话数据。
   • Amazon ElastiCache 用于缓存和会话状态。
   • 适用于 PostgreSQL 的 Amazon Relational Database Service（Amazon RDS） 作为关系型和向量存储，为 LibreChat 的 RAG API 提供上传文档支持。
   • Amazon OpenSearch Service 作为 Amazon Bedrock 的向量存储，支持对从 Confluence 摄取内容进行检索。
   • Amazon Elastic File System（Amazon EFS） 用于存储 MeiliSearch 索引。
   • Amazon Simple Storage Service（Amazon S3） 用于存储上传文件和聊天产物。
4. Agent 层（Strands + AgentCore）——Strands Agents 托管在 AgentCore runtime（Amazon Bedrock AgentCore 的一项能力）上，并通过由 AWS Lambda 和 Amazon API Gateway 支持的自定义端点向 LibreChat 提供服务。采用这一模式，团队可以在不更新聊天应用程序、也无需停机的情况下在 LibreChat 中加载新 Agent；随着采用规模增长，还可独立推出新的 Agentic 应用程序。

以下截图展示了 MRH Trowe 构建的使用情况仪表板，用于追踪采用情况和成本，包括独立用户数、按模型划分的 Token 消耗量以及每用户成本。

图 3：追踪独立用户数、按模型划分的 Token 消耗量、独立聊天数和每用户成本的使用情况仪表板

请求如何流转

以下步骤说明一个典型请求如何从员工浏览器流经系统到达 Agent，再返回给员工。

1. 员工打开 LibreChat，并从切换面板中选择一个 Agent。
2. LibreChat 通过 MRH Trowe 现有的身份提供商 Microsoft Entra ID 对用户进行身份验证。LibreChat 管理面板中的访问控制列表（ACL）决定用户可以访问哪些端点和模型。
3. 当用户调用 Agent 时，LibreChat 会通过 API Gateway 调用受 API 密钥保护的自定义端点。如果该端点支持 On-behalf-of（OBO）身份验证流程，也可以使用该流程进行用户身份验证。
4. Lambda 函数使用 AWS Identity and Access Management（IAM）角色，调用运行在 AgentCore runtime 上的 Strands Agent。
5. Agent 针对请求进行推理，调用其工具和获得授权的数据源，并在隔离且受治理的会话内通过 LibreChat 返回响应。

受监管环境下的安全性与合规性

在德国金融行业运营，数据保护和治理并非可选项。该架构采用分层方法：

1. 数据驻留在德国——敏感客户和保险数据保留在所选 AWS 区域内。
2. 私有连接——Transit Gateway 配置与零信任方案相结合，使员工流量不经过公共互联网。
3. 会话隔离——AgentCore runtime 在计算和文件系统层面隔离每个 Agent 会话。
4. 集中治理——单一的托管环境取代碎片化、缺乏管理的工具，使组织能够了解并控制 AI 的使用方式。
5. 强身份验证和授权机制——基于 Active Directory 组的角色和访问权限支持单点登录（SSO）及零信任方案。

借助这一基础，MRH Trowe 能够在安全且高度灵活的环境中为员工提供服务。AI 现已触手可及，组织鼓励员工探索，而 AWS 实现则确保安全性和治理能力能够规模化落地。

成果与业务影响

该解决方案的基础设施和 Token 成本约为每席位每月 14 美元。

该环境也成为新使用场景的孵化工厂。最新场景是“与数据对话”，支持由业务主导的分析，例如结合 CRM 数据与公开信息进行交叉销售和追加销售评估。

为推动采用，MRH Trowe 在部署的同时配套推进组织变革：

• 在各团队开展使用场景研讨会，以建立和维护高级用户群体。
• 利用采用数据识别高级用户，并将其工作流推广至整个组织。

“如果你和同事在重复做同一件事，不妨考虑创建一个 LibreChat Agent！”

— MRH Trowe 董事会成员 Leonid Karlinsky

除成本效率外，该框架还使员工能够在无需深厚技术技能的情况下，以安全、自助的方式构建和使用 AI Agent；所有操作均在符合受监管金融服务组织合规要求的集中治理环境中进行。

结论

MRH Trowe 表明，受监管的金融服务组织可以同时获得广泛的自助式 AI 访问能力，以及其所在行业所要求的控制力。通过结合开源技术的灵活性（Strands Agents 和 LibreChat）与 Amazon Bedrock AgentCore 的安全性、可扩展性和可靠性，MRH Trowe 在首月便为约 400 名员工提供了集中治理的 AI Agent 构建和使用方式，并且随着采用规模扩大，有明确路径进一步提升经济性。

通过打造数据与 AI 实践社区，MRH Trowe 的目标是在 2026 年年底前由领域专家创建和维护 10 至 15 个 Agent。

如需进一步了解如何在 AWS 上构建 AI Agent，请访问 Amazon Bedrock AgentCore 详情页 和 Amazon Bedrock AgentCore 文档。

Basic AI chat isn’t enough for financial services organizations that need secure, self-service AI agents. In financial services, employees need AI that can work with internal systems and sensitive client data, stay inside a governed environment, and remain auditable and cost-transparent. All of this must happen without every team standing up its own tools.

This post shows how MRH Trowe, one of Germany’s leading commercial and industrial insurance brokers, gave approximately 400 employees secure access to self-service AI agents. The rollout reached this scale in the first month of production. The framework combines Strands Agents, Amazon Bedrock AgentCore, and LibreChat to deliver the security, data residency, and compliance controls required in the German financial sector. The initial production cost was approximately $14 per seat in the first month, with a clear path to reduce infrastructure costs by about 40 percent through right-sizing and scheduled scaling.

About MRH Trowe

MRH Trowe is an owner-managed commercial and industrial insurance broker operating primarily in Germany, Switzerland, and Austria. Growing through both organic expansion and acquisitions, MRH Trowe was among the first German insurance brokers to operate on an exclusively cloud-based IT infrastructure. AWS is the preferred partner for this strategy, and the use of AI is a strategic corporate goal, specifically to streamline internal processes and enhance efficiency.

The challenge: Self-service AI without losing control

As a commercial insurance broker in a highly regulated industry, MRH Trowe saw growing demand from employees across the business to use generative AI in their daily work. Individual teams were beginning to experiment with AI on their own, which created the risk of fragmented, unmanaged tools and potential exposure of sensitive client and insurance data.

MRH Trowe needed a way to let employees build and use AI agents themselves, quickly and without deep technical skills. At the same time, everything had to stay within a secure, centrally governed environment that meets the data protection and compliance requirements of the financial sector. The core tension was clear: balance broad, self-service access to AI with the security, control, and cost transparency the organization required. The MRH Trowe vision: “every question should be first answered by AI before any human intervention, and repetitive processes should be automated by those who did them in the past.”

Basic chat interfaces fell short on several capabilities the business needed:

1. Contextual responses – Grounded in internal data, not only generic model knowledge.
2. Multi-step workflows – Tasks that require gathering information, reasoning over it, and taking action across several steps.
3. Institutional data integration – Secure connections to internal systems and document repositories.
4. Centralized governance – A single, governed application rather than shadow AI tools spread across teams.

The building blocks

The solution brings together three technologies, each addressing a specific part of the challenge.

Strands Agents

MRH Trowe’s builders use Strands Agents, an open source SDK that creates agents in a few lines of code. Strands handles the agent patterns, such as orchestration and reasoning, and scales from a builder’s laptop to production, so teams focus on the use case rather than the infrastructure.

Amazon Bedrock AgentCore

To run agents in production, MRH Trowe uses Amazon Bedrock AgentCore as a platform to build, connect, and optimize agents at scale, with any framework or model. AgentCore was the deciding factor for MRH Trowe: it natively supports open source frameworks such as Strands Agents, isolates each agent session at the compute and filesystem level, and offers a consumption-based model that gives the team cost transparency as adoption grows. This means the team keeps the flexibility of Strands without giving up the security and session isolation as a regulated broker requires.

LibreChat

LibreChat is an open source alternative to commercial AI chat interfaces. It gives MRH Trowe a familiar, brandable chat experience that drives immediate adoption, with the controls a regulated organization needs:

1. User management – Robust authentication and authorization to manage access across the employee base with appropriate permissions.
2. Token budgets – LibreChat’s built-in token budget system avoids unexpected costs.
3. Multi-model support – Flexibility to choose the most appropriate models per use case while avoiding vendor lock-in.
4. Conversation management – Employees can organize their AI interactions, creating a structured environment.
5. Customizable interface – Branded to match MRH Trowe’s identity.

In practice: From a Microsoft Teams meeting to a structured protocol in minutes

The first agent MRH Trowe put into production turns a Microsoft Teams meeting into ready-to-use meeting minutes. In LibreChat, an employee asks, in German, for a recent meeting with a given participant. The agent finds the meeting on the employee’s calendar, retrieves the transcript, and drafts a structured meeting summary with date, participants, agenda, topics, and action items. Manual note-taking after every call turns into a one-line request.

Two design choices make this safe for a regulated broker. First, every request runs as the signed-in employee. LibreChat authenticates through Microsoft Entra ID and passes the user’s identity to the agent server-side, so an agent can only reach that employee’s own calendar and transcript. The identity can’t be set from the chat box. Second, processing stays in-Region: the agents, model, and data run in the AWS Europe (Frankfurt) AWS Region, keeping client and meeting data in Germany. Amazon Bedrock AgentCore and the foundation models used in this solution are available in the Europe (Frankfurt) Region (eu-central-1). Service and model availability varies by AWS Region.

Solution architecture

The solution is deployed in a single AWS account inside a virtual private cloud (VPC), with employees connecting from the corporate network. The following diagram shows the solution architecture, including the connectivity, application, data, and agent layers described in this section.

Figure 1: Solution architecture spanning the connectivity, application, data, and agent layers

The main components are:

1. Secure connectivity – Employees access the system from anywhere using a transit gateway implementation combined with a zero-trust provider, keeping traffic on a private, dedicated connection rather than the public internet. An internal Application Load Balancer (ALB) routes requests to the application tier.

The following network view expands the secure-connectivity path, showing how on-premises users connect through the AWS networking account to the internal load balancer in the application account’s private subnet.

Figure 2: Network path from on-premises users through the AWS networking account to the internal load balancer

2. Application tier (LibreChat) – The chat experience runs as containerized services on Amazon Elastic Container Service (Amazon ECS) with AWS Fargate as the launch type, including the LibreChat service, a Retrieval Augmented Generation (RAG) API service, and a MeiliSearch service for fast text search without vectorizing the data.
3. Data layer.
   • Amazon DocumentDB (with MongoDB compatibility) for users, sessions, and conversation data.
   • Amazon ElastiCache for caching and session state.
   • Amazon Relational Database Service (Amazon RDS) for PostgreSQL as the relational and vector store backing LibreChat’s RAG API for uploaded documents.
   • Amazon OpenSearch Service as the vector store for Amazon Bedrock, supporting retrieval over content ingested from Confluence.
   • Amazon Elastic File System (Amazon EFS) for MeiliSearch indexes.
   • Amazon Simple Storage Service (Amazon S3) for uploaded files and chat artifacts.
4. Agent layer (Strands + AgentCore) – Strands Agents are hosted on AgentCore runtime, a capability of Amazon Bedrock AgentCore, and exposed to LibreChat through custom endpoints backed by AWS Lambda and Amazon API Gateway. With this pattern, the team can load new agents in LibreChat without updates or downtime to the chat application and roll out new agentic applications independently as adoption grows.

The following screenshot shows the usage dashboard MRH Trowe built to track adoption and cost, including unique users, token consumption by model, and cost per user.

Figure 3: Usage dashboard tracking unique users, token consumption by model, unique chats, and cost per user

How a request flows

The following steps describe how a typical request travels through the system, from the employee’s browser to the agent and back.

1. An employee opens LibreChat and selects an agent from a switch panel.
2. LibreChat authenticates the user through MRH Trowe’s existing identity provider, Microsoft Entra ID. Access control lists (ACLs) in the LibreChat admin panel determine which endpoints and models the user can access.
3. When the user invokes an agent, LibreChat calls a custom endpoint through API Gateway, secured with an API key. Or if the endpoint supports On-behalf-of (OBO) authentication flow, this can also be used for user authentication.
4. A Lambda function uses an AWS Identity and Access Management (IAM) role to invoke the Strands agent running on AgentCore runtime.
5. The agent reasons over the request, calls its tools and authorized data sources, and returns the response through LibreChat, within an isolated, governed session.

Security and compliance for a regulated environment

Operating in the German financial sector means data protection and governance are not optional. The architecture applies a layered approach:

1. Data residency in Germany – Sensitive client and insurance data stays within the chosen AWS Region.
2. Private connectivity – A transit gateway setup combined with zero trust keeps employee traffic off the public internet.
3. Session isolation – AgentCore runtime isolates each agent session at the compute and filesystem level.
4. Central governance – A single, managed environment replaces fragmented, unmanaged tools, giving the organization visibility and control over how AI is used.
5. Strong authentication and authorization mechanism – Active Directory group-based roles and access for single sign-on (SSO) and zero-trust solution.

With this foundation, MRH Trowe can serve employees in a secure and highly flexible environment. AI is now at the fingertips of every employee, and exploration is encouraged, while the AWS implementation keeps security and governance at scale.

Results and business impact

The solution ran at an infrastructure-and-token cost of about $14 per seat per month.

The environment has also become a factory for new use cases. The most recent is “talk to your data”, which supports business-led analyses such as cross-sell and upsell reviews that combine CRM data with publicly available information.

To drive adoption, MRH Trowe paired the rollout with organizational change:

• Run use case workshops across teams to create and maintain a power user group.
• Use adoption data to identify power users and promote their workflows across the organization.

“If you and your colleague are doing things twice, consider creating a LibreChat agent!”

— Leonid Karlinsky, Board member, MRH Trowe

Beyond cost efficiency, the framework delivered a secure, self-service way for employees to build and use AI agents without deep technical skills, all within a centrally governed environment that meets the compliance requirements of a regulated financial services organization.

Conclusion

MRH Trowe shows that a regulated financial services organization can have both broad, self-service access to AI and the control its industry demands. By combining the flexibility of open source (Strands Agents and LibreChat) with the security, scalability, and reliability of Amazon Bedrock AgentCore, MRH Trowe gave roughly 400 employees a centrally governed way to build and use AI agents in their first month with a clear path to make it even more economical as adoption grows.

By shaping a Data and AI Community of Practice, MRH Trowe aims for 10–15 agents created and maintained by subject matter experts by the end of 2026.

To learn more about building AI agents on AWS, visit the Amazon Bedrock AgentCore detail page and the Amazon Bedrock AgentCore documentation. To get started with open source agent development, see the Strands Agents SDK.

---

About the authors

Dr. Malte Polley

Dr. Malte has been working with AWS solutions since 2018, working both as an external consultant and as an internal solution architect, developer, and product owner. Since entering the insurance world at HDI in 2020, new areas of focus have been added to his work, such as regulatory compliance and ISO 27001 compliance. Having implemented two modern data platforms at HDI and MRH Trowe, as well as building a data science platform at HDI, Malte is very familiar with the pitfalls and requirements, but also the added value of such projects in the field of FSI. Malte finds relaxation and new ideas in his vegetable garden and on long walks in the forest with his dog.

Marouane El Bostahi

Marouane is a Technical Account Manager at AWS. He helps enterprise customers mature in their cloud journey, influencing stakeholders with a data-driven approach.

Safat Al Fahim

Safat is a Customer Solutions Manager at AWS on the EMEA scale CSM team. He helps FSI customers through enterprise transformation, driving large migrations, modernization and AI adoption acceleration programs and adoption of new services and processes.

Anna Sonntag

Anna is an Account Manager at AWS working with regulated enterprise customers. She supports them across their cloud journey, from migrations and modernization to AI adoption, with a focus on aligning AWS capabilities with customers’ strategic business priorities.