# Monday checklist — n8n orchestrates, AgentCore runs the agent

## Day 1 — Node and credentials

- [ ] n8n Cloud **or** self-hosted instance that can install verified community nodes
- [ ] Install `@aws/n8n-nodes-agentcore` (pin a version in production; review release notes)
- [ ] Supported AgentCore Region; enable the Bedrock model you will pin
- [ ] Caller IAM + separate execution role per [iam-caller-vs-execution.md](iam-caller-vs-execution.md)
- [ ] n8n credential: Region, execution role ARN, temporary keys if possible

## Day 2 — Lab invoke, then pin

- [ ] Non-prod: leave Harness ARN blank once, confirm harness + memory provision, copy the ARN
- [ ] Prod workflow: **paste Harness ARN**; hide Force Recreate; pin named endpoint/qualifier if you use versions
- [ ] Stable **Session ID** for multi-turn; **Actor ID** per user/tenant when Memory is on
- [ ] Confirm first invoke ~30–60s on create, subsequent invokes seconds (AWS ML Blog walkthrough)

## Day 3 — Tools and HITL

- [ ] Read tools: Gateway or MCP — not ad-hoc secrets in n8n Code nodes
- [ ] Write tools: Gateway **Policy** (Cedar) before the agent can mutate systems of record
- [ ] Browser / Code Interpreter **off** unless the turn needs them
- [ ] High-impact business writes stay on n8n approval / Wait nodes after the agent returns
- [ ] Optional: inline function round-trip for in-loop HITL (`stopReason: tool_use` → second node with Tool Results)

## Day 4 — Host and network

- [ ] If self-host: RDS Postgres + queue mode — [EKS checklist](https://www.factualminds.com/examples/architecture-blog-2026/n8n-eks/n8n-eks-production-checklist.md)
- [ ] If VPC harness: ECR + S3 (+ Bedrock Runtime) VPC endpoints; no NAT required for managed image pull
- [ ] `N8N_ENCRYPTION_KEY` in Secrets Manager, not in the workflow JSON

## Day 5 — Observe and cost

- [ ] CloudWatch GenAI observability / OTEL for AgentCore; n8n execution logs separately
- [ ] Alarm on harness errors, Gateway tool failures, and Bedrock/AgentCore daily spend
- [ ] Model platform + tokens on the [AgentCore pricing calculator](https://www.factualminds.com/tools/amazon-bedrock-agentcore-pricing-calculator/)
- [ ] Delete lab harnesses you will not keep (`delete-harness`)

## Hard stops

- [ ] No n8n built-in AI Agent node as the production agent runtime when you need isolation, managed Memory, Browser, or Code Interpreter
- [ ] No blank Harness ARN in production workflows
- [ ] No Agents Classic for net-new builds after Jul 30, 2026
- [ ] No Browser-on-every-turn