Context

Engie’s NAC teams run network and security operations for a global group. Dozens of tools. Thousands of incidents a year. A lot of repetitive work.

The AI for NAC program had a clear goal: put AI agents to work for these teams. With one non-negotiable constraint: security, traceability and cost control from day one.

The challenge

  • Connect agents to a heterogeneous tool estate without exposing secrets or opening uncontrolled flows.
  • Measure an agent’s answer quality continuously, not just in a demo.
  • Move an agent to production without losing operators’ trust.
  • Give technical and non-technical teams the means to build their own tools.

Our approach

A platform built from scratch. Agents on Amazon Bedrock AgentCore with Claude and the Strands SDK. AgentCore Gateway as the MCP proxy, translating JWT to SigV4. Machine authentication through IAM Roles Anywhere (X.509 certificates), a private API Gateway, and dedicated KMS keys.

16 MCP servers. Cisco, FortiGate, Palo Alto, Meraki, SD-WAN, Zscaler, Spectrum, Splunk, Observium, ServiceNow, CMDB, Neo4j topology, AWS, Okta, planned works, Microsoft 365. Each agent reaches the tools it needs. Nothing more.

Quality measured continuously. An online evaluation framework with 14 evaluators. An agent registry tracking what is approved and deployed. A FinOps dashboard tracking cost, tokens, energy (Wh) and carbon (gCO2e) for every execution.

A shadow, suggest, auto lifecycle. An agent starts by observing, then suggests, then acts. It only moves up a level after meeting five criteria: recurrence, determinism, reversibility, observability, consensus.

A V2 target architecture. Multi-source event management, deterministic routing instead of an orchestrator agent, only two agents, and skills reserved for what truly needs a model. V2 stays on Bedrock AgentCore, in continuity with the first agent.

AI in the hands of the teams. A Claude Code toolkit (skills and workflows) so developers and non-developers can build internal tools. The NAC Hub to publish and host them on AWS: private API, Engie network only, with an internal marketplace cataloguing the sites.

Results

  • 39 active engineers, 300+ sessions and around 1 billion tokens in five months.
  • A first production agent, the Monitoring Agent: around 4,300 incidents a year targeted and the equivalent of 2.5 FTEs freed, with v1 production planned for Q4 2026.
  • A formal bilingual architecture dossier and a repeatable governance model for every new agent.
  • The NAC Hub architecture presented to Engie on October 20, 2026.

Key takeaway

An agent creates value once it runs on a governed, observable, secure platform. Platform first. Agents follow.