AWS is adding controls to Amazon Bedrock AgentCore that look at an AI agent’s sequence of actions, not only whether each individual tool call appears valid. The new temporal policies are designed for cases where risk emerges from a pattern, such as repeated transfers, cumulative spending, or retries that burn through a token budget.
The feature is powered by Dogwood, an open source policy language built for AI agents, and runs through the AgentCore gateway. Because traffic to tools, Model Context Protocol servers, agents, and models can pass through that gateway, AWS argues the controls belong in shared infrastructure rather than being reimplemented in each app.
AgentCore policies already check stateless permissions for individual actions. Temporal policies add session context, allowing a later action to be allowed or denied based on what the agent has already done. AWS is also adding rate limiting to help control usage and cost.
The update reflects a broader enterprise concern: agents are harder to govern than predictable software because they choose their own path. Infrastructure-level controls could make them easier to approve, but teams still need careful policy design and monitoring.