# Responsibility matrix — n8n vs AgentCore

Keep workflow orchestration separate from agent reasoning. This matrix is the architecture contract for the post.

| Layer | Owns | Does not own |
| ----- | ---- | ------------ |
| **n8n** | Triggers (webhooks, schedules, queues), routing, SaaS/API fan-out, human approval branches, CRM/ERP writes after the agent returns, execution history of the *business* workflow | Agent loop, microVM isolation, long-term agent memory, Browser / Code Interpreter sandboxes, Cedar tool Policy |
| **Amazon Bedrock AgentCore** | Harness or Runtime execution, session isolation, Memory, Gateway tools, Identity / credential brokering, Observability traces, Evaluations, Policy on Gateway | Ticket routing rules, SLA escalation calendars, which Salesforce field to patch, who must approve a refund |
| **Amazon Bedrock (models)** | Foundation model inference (and Mantle/OpenAI-compatible paths where configured) | Tool IAM, workflow branching, human approval |
| **Enterprise systems** | System of record (CRM, ERP, ticketing, data stores) | Agent prompts and session memory strategy |
| **Humans** | High-impact approvals, exception handling, policy exceptions | Day-to-day tool dispatch inside the agent loop |

## Invoke path (documented)

Business event → n8n workflow → Amazon Bedrock AgentCore node (`@aws/n8n-nodes-agentcore`) → **InvokeHarness** (or auto-provision in lab) → tools via Gateway / Browser / Code Interpreter / inline function → agent response → n8n continues (approval, CRM update, notify).

Inline functions (node v0.2+): the harness can stop on `tool_use`, n8n computes or collects a human result, then a second node placement resumes the same **Session ID**. That is HITL *inside* the agent turn, not a substitute for n8n Wait/approval nodes on irreversible business writes.

## Production default

Pin **Harness ARN** (and a named endpoint/qualifier when you use versions). Leave ARN blank only in non-prod so the node can create and reuse a harness.