BMA mobile invokes a WebSocket integration via Imperva WAF → Azure API‑M. API‑M calls an internal Agent uAPI to retrieve AWS API Gateway credentials from Key Vault and brokers to a Health Assistant API fronted by AWS API Gateway. The Health Assistant interacts with Amazon Bedrock (AgentCore, LLMs, vector indexes) and persists conversation history in DynamoDB, linked to the user by BK OID embedded in a JWT. The solution proposes per‑message authorization, input validation, rate‑limiting, session controls and monitoring at API‑M/uAPI; and JWT/BK‑scope authorization at the AWS API Gateway/Health Assistant.