Amazon Bedrock AgentCore has introduced temporal policies to enhance the security of AI agents by enforcing rules based on session history. These policies address the unique challenges posed by AI agents, which operate differently from traditional applications by making runtime decisions about tool calls and their order. The new feature allows for the enforcement of authorization rules that consider an agent’s session history, ensuring actions are authorized in the context of prior events. This approach helps prevent harmful actions that may appear safe in isolation but become problematic when viewed in the sequence of an agent’s actions. Source: awsml
Temporal policies in Amazon Bedrock AgentCore are designed to evaluate requests in the context of an agent’s trajectory, which is a sequence of actions identified by a principal and session ID. These policies operate at the gateway, outside the agent’s code, making them resistant to bypassing. They enable the enforcement of workflow sequencing, prevention of data fabrication between tool calls, and capping cumulative financial exposure per session. Additionally, they allow for requiring human approval for high-value actions and automatically tightening permissions when an agent operates without human engagement. The policies are applied to all types of calls made through the gateway, including model inference calls, agent-to-agent calls, and tool calls, providing a consistent method for evaluating an agent’s behavior over time. Source: awsml
The source explains that existing access controls in AgentCore enforce stateless, deterministic rules on each individual request, which are often insufficient for AI agents. Temporal policies extend these controls by introducing trajectory-aware enforcement, which considers the ordered sequence of actions in a session. These policies are evaluated against the current request and recent trajectory events, ensuring that authorization decisions are based on the full context of an agent’s actions. The policies operate on traffic flowing through the AgentCore Gateway and apply to all three types of calls an agent might make through the gateway. Source: awsml
