Amazon Bedrock adds temporal policies to control AI agent actions

AI agents present a fundamentally different security challenge than traditional applications. While conventional software relies on deterministic business logic to enforce the correct sequence of actions and data freshness, AI agents decide at runtime which tools to call, in what order, and with which arguments. This flexibility, combined with increasingly capable models, creates scenarios where a single tool call appears safe in isolation but becomes harmful when considered in the context of prior actions—such as an agent hallucinating a different account number after reading from an untrusted data source, or executing dozens of trades in a loop without tracking cumulative exposure.

Amazon's temporal policies extend the existing stateless policy engine in AgentCore by introducing trajectory awareness. A trajectory is the ordered sequence of actions within a session, and temporal policies evaluate the current request against that history. By running at the gateway perimeter rather than within the agent's code, these policies cannot be bypassed or manipulated by the agent itself. This architectural choice is critical: agents never see the policy logic, never touch the state store, and cannot alter the controls.

The feature is built on Dogwood, a new open-source governance language designed for agents and compatible with existing Cedar policies, allowing customers to migrate gradually. For financial services firms managing AI agents that handle client portfolios, temporal policies address compliance requirements: enforcing that advisors retrieve client profiles and load portfolios before trades, that the portfolio ID in a trade matches the client profile output, that market prices are retrieved within 1 minute of trade execution, and that any trade over $25,000 requires explicit advisor approval. Sessions are bounded by a 24-hour look-back window, and sessions are uniquely identified by combining a session ID with the end user's identity, ensuring policies apply independently to each trajectory based on underlying identity.