Natera’s AgentCore Voice Agent Shows a Regulated AI Pattern

A production voice-agent case study for a regulated workflow

AWS and Natera published the architecture of Natera's Bedrock AgentCore voice scheduling agent on August 26, 2026. The system handles inbound mobile-phlebotomy appointment scheduling and is presented as a customer implementation, not a generally applicable healthcare-performance guarantee.

The design bridges telephony, real-time voice processing, foundation-model tools, memory and backend scheduling services. Its most reusable ideas are the separation of communication channels, progressive access control and per-step observability.

Dual WebSockets keep telephony and model inference replaceable

An orchestration layer maintains one WebSocket with the telephony provider and a second with the real-time voice service. It relays audio, intercepts tool calls, executes business logic and returns results to the conversation.

Separating the two sides means a team can change the telephony or model layer without redesigning the entire system. The trade-off is more state-management complexity: long-lived connections, tool execution, filler responses and session memory must remain synchronized.

Natera migrated the orchestration workload from self-managed Amazon ECS containers to AgentCore runtime. Session state moved from container-local memory into AgentCore memory, and the team used connection pooling so WebSockets persist for the duration of a call even though the underlying runtime is invocation-scoped.

Latency masking focuses on the caller's experience

Instead of treating every pause as an inference-speed problem, the system measures latency for each tool. When a slower authentication or scheduling call begins, a parallel loop can generate a short contextual acknowledgment before silence becomes noticeable.

AWS says tracing showed that 70% of perceived latency came from one vendor API rather than the language model. That finding illustrates why end-to-end averages are insufficient for agents: each tool, retrieval operation and model call needs independent timing.

Progressive trust limits sensitive actions until verification

A caller begins in an unauthenticated session keyed to a hashed phone-number identifier. After full identity verification, the system creates an authenticated session tied to the verified patient and transfers the conversation history.

Sensitive tools are unavailable before verification and remain scoped to the authenticated session afterward. The agent is also designed not to provide medical advice, diagnosis or result interpretation, and specified safety signals trigger escalation to a human.

This is an architecture description, not a substitute for an organization's own legal, privacy, clinical-safety or security review.

Natera and AWS report validation and early-production results

Across 500 simulated end-to-end calls, the companies report 100% tool-selection and parameter accuracy. They also report a 6.8-second median perceived latency, cost below one US cent per completed call and response accuracy above 90% against a human-reviewed scheduling dataset.

The agent is now in production for inbound scheduling. Over a reported four-week window, it handled 4,744 calls; the share of calls ending within 30 seconds fell from 22% to 12%, while satisfaction proportions remained broadly stable.

These figures come from the implementation team and its selected validation and reporting windows. Other organizations should expect different results based on telephony, models, vendors, authentication requirements, traffic and test coverage.

The most valuable lesson is architectural: regulated voice agents need identity boundaries, tool-level authorization, representative testing, human escalation and detailed traces—not only a conversational model.