SBA · SBA-40 · record R3195

Multi-Agent Orchestration

Small Business Administration · OCIO: Office of the Chief Information Officer

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not high impact: This AI system does not meet the criteria of any of the six pillars that make up High Impact AI in Memorandum M-25-21.
Start date: 2026-01-01 (day precision)Source: 01/01/2026 00:00:00
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Service Delivery
Operational functions: No function tag matched Derived by keyword rules; see methodology

Problem the AI is intended to solve

SBA maintains millions of lines of legacy ColdFusion and COBOL code supporting mission-critical lending systems (CAFS) with minimal test coverage and significant technical debt. Manual code refactoring, test case generation, and project management across modernization initiatives are resource-intensive and error-prone, creating risk during cloud migration.

Expected benefits

Multi-agent AI orchestration will accelerate legacy code modernization by automating code refactoring recommendations, generating comprehensive test suites for financial calculation modules, and streamlining project management workflows. Expected benefits include reduced manual effort for QA testing, improved code quality and test coverage for CAFS applications, faster time-to-migration for AWS EVS initiatives, and better coordination across modernization workstreams.

System outputs

Multi-agent system using Amazon Bedrock with foundation models. Agent Teams coordinate specialized agents for: (1) Code Refactoring — analyzes legacy ColdFusion/COBOL code and recommends modernization patterns, (2) Automated Testing — generates unit, integration, and regression test cases for financial calculation modules, (3) Project Management — synthesizes sprint status, identifies blockers, and coordinates task dependencies across modernization teams. Input: source code repositories, project management data, test specifications. Output: refactored code suggestions, test case files, project status summaries, risk assessments. All outputs require human review and approval before implementation.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): Amazon Bedrock (FedRAMP Authorized)
Custom-developed code: Yes
Public source code: Not publicly available - Government internal use code

Sourcing

How it was built: Contract and in-houseSource: c) Developed with both contracting and in-house resources
Vendor (as reported): Amazon Web Services (AWS)
Vendors (standardized): Amazon Web Services

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: No
Privacy Impact Assessment: Not publicly available
Authorization to Operate: Yes
Demographic features: k) None of the above
Training and evaluation data: No model training or fine-tuning is performed. Uses foundation models via Amazon Bedrock inference API with agency-provided context through retrieval-augmented generation (RAG) and prompt engineering. Code repositories and project data are provided at inference time only.
Federal Data Catalog: Not applicable - Internal agency data not publicly disclosed

Governance

8 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingReported in progressSource: b) In-progress

AI impact assessmentReported in progressSource: b) In-progress

Independent reviewReported in progressSource: d) In-progress

Ongoing monitoringReported in progressSource: b) Development of monitoring protocols is in-progress

Operator trainingReported in progressSource: b) Establishment of sufficient and periodic training is in-progress

Fail-safeReported in placeSource: a) Yes

Appeal processNot applicableSource: b) Not applicable

User and public consultationReported in progressSource: Planning includes phased proof-of-concept with development team evaluation, structured feedback from developers and QA engineers during pilot, iterative refinement of agent prompts and workflows based on output quality metrics, and stakeholder review of generated artifacts before production adoption.Flag: free-text answer

Potential impacts and how they were identified

Impact assessment in progress. Primary risks include AI-generated code introducing logic errors into financial calculation systems, hallucinated test cases that provide false confidence in code correctness, and potential exposure of sensitive system architecture through agent context. Mitigated by mandatory human code review for all AI-generated refactoring, validation of generated tests against known-good outputs, sandboxed execution environments, and role-based access controls. Identified through internal technical architecture review and AWS ProServ security assessment.