AWS has set out a five-layer framework for giving AI agents more autonomy without asking people to approve every action. Called Trust in Depth, it covers scope before execution, identity at deployment, boundaries during a run, observation afterward and proof for rules that can be expressed mathematically.
The approach begins by defining the job, permitted tools and data, prohibited actions and decisions that must remain with a person. AWS Agent Registry can catalog approved agents and tools, while AgentCore assigns each agent an identity so actions can be tied to a known authority.
Runtime policy is enforced outside the model on every tool call through AgentCore Gateway. That separation is important when an agent is buggy or follows a prompt injection: the model cannot turn off a control it does not operate. Logs should then make the full sequence of actions reconstructable rather than recording isolated outputs.
AWS says automated reasoning can prove a precise rule across the paths covered by a formal system description, or produce a counterexample. A rule such as “only a manager may approve access” fits that method; a requirement to use a friendly tone does not. Proof is also only as sound as its assumptions. Ambiguous behavior still needs evaluations, restricted permissions and human judgment rather than a blanket claim that the agent is safe.