Amazon Bedrock AgentCore now offers temporal policies, security rules that track an AI agent's session history and make authorization decisions based on the full sequence of prior actions.
This addresses a key vulnerability: stateless access controls can miss harmful patterns that only become apparent when looking at an agent's trajectory over time.
Temporal policies run at the gateway perimeter outside the agent's code, preventing circumvention.
What happened
Amazon introduced temporal policies in Bedrock AgentCore, a security layer that tracks and evaluates an AI agent's decision history at the gateway level. Unlike traditional stateless access controls, temporal policies can see the full sequence of actions a session has taken and block tool calls based on prior context—for example, preventing an agent from using a hallucinated account number after reading from an untrusted source.
Why it matters
AI agents decide at runtime which actions to take in what order, making them harder to control than conventional applications. A single tool call might look safe in isolation but harmful in context (e.g., after reading bad data). Temporal policies run outside the agent's own code, so the agent cannot bypass or manipulate them regardless of how it is prompted or if bugs exist in its code.
What to watch
The example shows practical use cases: enforcing tool-call order (e.g., fetch client profile before executing a trade), requiring market prices be fetched within 1 minute of a trade, capping session exposure (e.g., $60,000 total trade value), and requiring human approval for trades over $25,000. Temporal policies are written in Dogwood, a new open-source governance language that remains compatible with existing Cedar policies.
Ask the AI about this article →
AI agents introduce a new security challenge that traditional access controls cannot fully address. In conventional applications, business logic deterministically enforces the correct order and state of operations; each action can be evaluated independently. AI agents, by contrast, decide at runtime which tools to call, with which arguments, and in what order. A tool call that appears safe when viewed in isolation can become dangerous in context—for example, an agent that retrieves an account number from an untrusted source might hallucinate a different number before passing it to a transfer function, or a runaway agent might execute dozens of trades in a loop, accumulating exposure that exceeds policy limits, with no mechanism to track the session total.
Temporal policies address this gap by introducing stateful authorization at the gateway layer. They evaluate each request not just on its own merits but in the context of the agent's trajectory—the ordered sequence of actions taken within a session. Because these policies operate outside the agent's code, at the AgentCore Gateway perimeter, they cannot be bypassed or manipulated by the agent itself, regardless of prompting or implementation bugs. The example workflow in a private banking scenario illustrates the practical power: enforcing that a client profile is fetched before a portfolio is loaded, and that a portfolio loaded in one call matches exactly the portfolio ID passed to a trade execution call, prevents common failure modes while allowing the agent flexibility in how it reaches its goal.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
CBTS Technology Solutions LLC launched Forge Agents, a platform that turns a plain-language job description in…
Imec CEO Patrick Vandenameele said at SEMICON Taiwan 2026 that the Belgian research center is broadening its c…
Alphabet's AI Overviews now reach over 2.5 billion monthly users through Google Search, and its ad business ge…
Amazon Web Services (AWS) has integrated its fully managed data warehouse service, Amazon Redshift, with Agent…
Visual Studio Code 1.135 now includes an experimental 'Rubber Duck' feature that lets developers request a sec…
Sonos announced a new app update with generative AI features, a new soundbar called the Beam Ultra, and its se…
