Bottom line: AWS is adding temporal policies (based on the open-source language Dogwood) and rate limiting in the Gateway to Amazon Bedrock AgentCore, enabling control over AI agents’ action sequences and budgets rather than just individual actions.
AWS is introducing new control mechanisms for Amazon Bedrock AgentCore that no longer just check individual actions of AI agents, but evaluate entire action sequences. According to McKinsey data, around 80 percent of companies have already observed risky behavior from AI agents.
Previous policy systems in Bedrock AgentCore check each of an agent’s actions statelessly and individually: who may call which tool under which conditions. However, this model fails to detect patterns that only become problematic across multiple steps. AWS cites three real-world examples: an agent retrieves account data and subsequently transfers funds to a different account number, because each call was evaluated in isolation as legitimate. An agent places multiple orders, each below the approval threshold, without the total sum being checked against a budget. An agent encounters a faulty tool and repeats the call unchecked overnight, depleting the token budget.
To address this problem, AWS is introducing temporal policies based on a new open-source policy language called Dogwood, developed specifically for AI agents. Instead of evaluating each request in isolation, the policy engine takes into account the sequence of previous actions within a session. For example, a policy can require that a value passed to a call match the return value of an earlier call, which would block the erroneous transfer in the example mentioned above. Similarly, expenditures can be summed across a session and further purchases blocked once a budget is reached, even if the individual purchase is below the individual limit. Additionally, teams can enforce a fixed sequence of steps, require logged human approval for critical actions, or automatically restrict permissions once no human is actively involved anymore.
In parallel, AWS is introducing rate limiting in AgentCore’s Gateway. The Gateway is a fully managed, serverless entry point for AI traffic that routes requests to MCP servers, LLMs, agents, and knowledge bases. Since every call passes through this Gateway, it serves as a central point for enforcing limits that apply independently of an individual agent’s behavior, for example to prevent uncontrolled depletion of token budgets through faulty retry loops.
For engineering teams operating agents in production, this means that security controls can increasingly be shifted to AgentCore’s infrastructure layer rather than being implemented individually in each agent’s code. This reduces inconsistencies between teams and makes budget, sequencing, and approval rules centrally enforceable and auditable.
Source: aws.amazon.com · Published August 6, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.