Control agent behaviors and cost beyond a single action: new capabilities in Amazon Bedrock AgentCore
AWS Madhu Parthasarathy ● Covered by 3 sources
AWS added new guardrails to Bedrock AgentCore that watch an agent's whole sequence of actions, not just each step alone. Plus token/request rate limits to stop runaway agents from blowing budgets.
AWS just shipped two features for Bedrock AgentCore that tackle a problem most AI safety tools completely miss: an agent can do everything right, one step at a time, and still cause a disaster.
Think about it this way. An agent checks a customer's account, that's fine. Then it wires money to a different account number, also fine on its own. Each action passes review individually, but the sequence adds up to fraud. Same story with spending: five purchases each under the approval threshold can still blow past a budget nobody was tracking. Traditional guardrails, built for software that behaves predictably, check requests one at a time and never see the shape of the whole. AWS's answer is temporal policies, powered by a new open-source policy language called Dogwood, built on top of AWS's existing Cedar language. Dogwood adds constructs for rate limits, time windows, required prerequisite steps, and escalation triggers, and it runs at the gateway, outside the agent's own code, so no amount of clever prompting lets the agent reason its way around it.
The second piece is rate limiting, and it's arguably the more immediately useful one for anyone who's watched a cloud bill spike overnight. Agents decide their own pace, so a stuck retry loop or an unusually chatty reasoning session can burn through tokens at whatever speed the model feels like. AWS now lets teams cap consumption per user, tied to existing OAuth or IAM identities, across requests, tokens, and connection duration, enforced in per-second and per-minute windows. That matters because different failure modes show up differently — a retry storm looks like request volume, a heavy reasoning task looks like tokens, a long idle session looks like an open connection doing nothing. Cap only one of those and an agent finds the gap.
Both features live at the gateway layer, AgentCore's managed entry point that already routes traffic to MCP servers, LLMs, and knowledge bases. Nothing about existing agent code needs to change, according to Madhu Parthasarathy, the AgentCore GM who wrote the announcement, and both capabilities can be adopted independently. AWS is leaning on some grim survey numbers to justify the timing: McKinsey found 80% of organizations have already run into risky agent behavior, and Forrester points to cost as a top reason agentic AI projects stall before reaching scale.
The framing here is deliberate and, honestly, pretty sound: trust in an agent isn't really about the model, it's about whether the system around it holds up when the agent does something nobody predicted. That's a boring, plumbing-level argument, but it's the right one. Enterprises don't scale AI agents because a model got smarter; they scale them because someone can prove, with logs and deny-by-default policies, exactly where the boundaries are.
My take
Releasing Dogwood as an Apache 2.0 open-source spec is the smart move here, not the charitable one — AWS wants this to become the de facto grammar for agent governance before competitors ship something incompatible, the same playbook Amazon has run before with infrastructure primitives. That said, credit where due: pushing security into the infrastructure layer instead of leaving every team to hand-roll their own guardrails is exactly the boring, unglamorous work the agent hype cycle keeps skipping over, and it's the only thing that actually earns enterprises' trust rather than asking for it.
Read more about this at: AWS
