Securing AI agents with temporal policies in Amazon Bedrock AgentCore
AWS Sean Eichenberger ● Covered by 4 sources
AWS built temporal policies for Bedrock AgentCore that judge AI agents by their whole session history, not just one action. That means an agent can't fake data, skip steps, or blow past spending limits without getting blocked at the gateway.
Based on reporting by AWS, Sean Eichenberger — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Access control used to be simple: check the one action in front of you and decide yes or no. AI agents break that model completely, because they choose their own tools, arguments, and order at runtime, and a call that looks fine on its own can be dangerous once you know what happened right before it. AWS is addressing that gap with temporal policies inside Amazon Bedrock AgentCore, a new layer that looks at an agent's entire trajectory, not just the current request, before deciding whether to let a tool call through.
The mechanism sits at the AgentCore Gateway, outside the agent's own code, so the agent itself has no way to see, touch, or tamper with the policy logic. Every session gets tracked with a session ID header, combined with the caller's identity, and the policy engine holds up to 24 hours of trajectory history to check against. Change the policies attached to an engine, and every existing session gets invalidated automatically, which keeps enforcement tied to current rules rather than stale ones.
AWS walks through the idea using a hypothetical private banking agent that pulls client profiles, loads portfolios, checks market prices, and executes trades for wealth advisors. The compliance requirements read like a checklist for exactly the kind of failures stateless controls miss: profile lookup has to happen before portfolio load, which has to happen before any rebalancing; the portfolio ID used in a trade must exactly match what get_client_profile actually returned, blocking prompt-injection attempts to redirect funds; and market prices used for a trade execution have to be no older than a defined freshness window, so the agent can't act on a stale quote in a fast-moving market.
The policies are written in Dogwood, a new open-source governance language AWS built specifically for agents and their tools, and it's designed to keep working with existing Cedar policies so nobody has to migrate what they already have. Under the hood, every decision is deny-by-default with forbid always beating permit, and the system logs full context on every denial. AWS also flags a practical migration note: teams with policy engines already running in ENFORCE mode can drop to LOG_ONLY while testing temporal rules, but doing that in production means those security rules stop actually enforcing anything, which rather defeats the purpose.
The broader case AWS is making is that agents need a different kind of governance than the request-by-request checks that worked for traditional software. A lookup that's technically permitted becomes a problem the moment it feeds a fabricated value into a money-moving tool three steps later, and no amount of per-call validation catches that on its own. Trajectory-aware enforcement is AWS betting that the real vulnerability in agentic systems isn't any single action, but the sequence.
My take — AI-written commentary, not fact-checked reporting
This is the unglamorous plumbing that agentic AI actually needs before anyone should trust it with real money movement, and it's telling that AWS had to invent a governance language just to express rules like 'don't sell at a loss right after buying.' The prompt-injection defense here — checking outputs against what a trusted system call actually returned, rather than what the LLM claims — is the correct instinct, and every vendor shipping agents with tool access should be doing something equivalent instead of hoping their model just behaves.
Read more about this at: AWS