Amazon Bedrock AgentCore can now judge agents by what they did before, not just the current call! Rate limiting joins the party too!

Hi, it's Shii! Today I found news that should make anyone running AI agents in production pretty happy. The controls for keeping agents from going off the rails just got stronger, so let me walk you through it!

AWS What's New aws.amazon.com

What was announced?

Over on AWS What's New, AWS announced two new controls for Amazon Bedrock AgentCore.

• Temporal policies — stateful authorization rules that take an agent's prior actions within a session into account
• Rate limiting — control over how much AI traffic flows through the gateway, scoped per user or per group

True to the AWS What's New format, the announcement itself is short, but what it enables really matters for running agents safely.

The story so far

Until now, authorization checks basically judged whether the current tool call was safe on its own, in isolation. But in practice, a single tool call that looks harmless can become risky depending on what the agent did right before it.

For example, looking something up is harmless by itself, but if a purchase call immediately follows a lookup, whether to allow it can depend entirely on the context that led up to it. A system that only looks at one call at a time simply couldn't capture that kind of context-dependent risk.

What changes

With temporal policies, you can now define authorization rules at the AgentCore gateway that take an agent's prior actions in the session into account. Specifically, you can:

• Enforce workflow sequencing, so tools can only be called in a defined order
• Require that a tool argument exactly matches the output of a prior call
• Require human approval before privileged actions are taken
• Enforce data freshness, blocking actions based on stale data

Rate limiting lets you control traffic to the tools, models, and agents connected to your gateway, scoped per user or per group. Using rules scoped by OAuth or AWS IAM, you can set:

• Request limits across all target types
• Token limits for inference targets
• Concurrent connection limits, to cap long-lived sessions

This helps protect downstream service availability while enforcing fair distribution of limits, so one runaway agent or user can't starve everyone else's traffic.

Dive Deep

A key point about temporal policies: the authorization logic is enforced at the gateway layer, outside the agent's own code. Instead of baking rules into the agent's prompt or code, you define them as policies at the gateway.

AWS is also releasing a policy language for this called Dogwood, an open source specification (Apache 2.0 licensed) designed for agent governance. A reference implementation is available on GitHub at dogwood-policy, so you can see actual policy code in action.

For setup details and regional availability, check the AgentCore documentation, and for the design thinking behind the release, see the announcement blog. For pricing and the full list of supported regions, those docs are the place to look.

Wrap-up

• Amazon Bedrock AgentCore now supports temporal policies, which factor in an agent's prior actions within a session
• You can enforce workflow sequencing, require argument matches to prior outputs, require human approval, and enforce data freshness
• New rate limiting controls let you cap requests, tokens, and concurrent connections per user or group
• Policies are written in a new open source language called Dogwood (Apache 2.0)

This update is especially worth checking out if you're running agents with real permissions in production and have been worried about single-action checks not being enough, or about one user hogging all the traffic!