Securing AI brokers with temporal insurance policies in Amazon Bedrock AgentCore

Earlier than AI brokers, it was usually enough for entry controls to deal with every motion as an impartial occasion. Functions relied on deterministic enterprise logic to implement whether or not actions occurred in the fitting order or whether or not the info was up-to-date. AI brokers behave in basically alternative ways than conventional purposes. They determine at runtime which instruments to name, with which arguments, and in what order. That flexibility, mixed with more and more clever fashions, makes brokers equal measures succesful and difficult to regulate. One instrument name is perhaps deemed secure when thought-about in isolation, however dangerous within the context of the previous name, equivalent to after studying from an untrusted knowledge supply. The query then turns into, how do you implement authorization guidelines that account for an agent’s session historical past, in a means the agent can’t circumvent?

Temporal insurance policies in Amazon Bedrock AgentCore allow you to outline stateful guidelines that decide authorization to AgentCore Gateway targets by evaluating the present request within the context of prior occasions in an agent’s trajectory. As a result of these insurance policies run on the AgentCore Gateway perimeter, exterior the agent’s personal code, the agent can’t intercept or manipulate them.

On this submit, you’ll study what temporal insurance policies are, how they work, and stroll via an instance to display. We are going to present you easy methods to use temporal insurance policies to implement workflow sequencing, forestall knowledge fabrication between instrument calls, cap cumulative monetary publicity per session, and require human approval for high-value actions. Additionally, you will see easy methods to routinely tighten permissions when an agent operates with out human engagement. First, nevertheless, we are going to discover the wants and use instances for stateful insurance policies in additional element.

Why brokers want stateful coverage enforcement

Current entry controls in AgentCore Coverage implement stateless, deterministic guidelines on every particular person request: who can name which instrument, beneath what circumstances. Stateless controls are vital however usually inadequate for brokers. Take into account the next situations the place current stateless controls fail to catch important points:

• An agent calls a lookup_customer instrument, hallucinates a distinct account quantity than what was returned, and passes it to a transfer_funds instrument that then strikes cash to the improper buyer’s account.
• A runaway agent executes dozens of trades in a loop as a result of nothing tracks that cumulative publicity has already exceeded the chance restrict.
• An agent each approves and denies the identical insurance coverage declare inside seconds.

Every particular person instrument name in these situations would go a stateless coverage test. The issue solely turns into obvious while you have a look at the agent’s trajectory, the ordered sequence of actions in a session. Temporal insurance policies prolong Coverage in AgentCore with this trajectory-aware enforcement layer. Temporal insurance policies run on the gateway, exterior the agent’s code, in order that they can’t be bypassed no matter what the agent does, how it’s prompted, or what bugs exist within the agent code. Some frequent temporal coverage use instances embody:

• Implementing output integrity throughout chained instruments. Require that an argument handed to the present instrument name precisely matches the output of a previous instrument name, stopping the agent from hallucinating or substituting values between steps.
• Implementing tool-call ordering. Require that one instrument is named earlier than one other instrument to confirm normal working process (SOP) adherence.
• Requiring human approval earlier than privileged actions. Block harmful or delicate instrument calls till an specific human approval occasion is recorded within the trajectory.
• Implementing knowledge freshness. Require {that a} knowledge lookup accomplished inside a given timeframe earlier than a dependent motion is allowed, stopping selections based mostly on stale data.Temporal insurance policies are authorization controls that reply the query “given the latest trajectory noticed on the AgentCore Gateway, is that this particular request licensed?”. They consider whether or not a gateway-routed request needs to be permitted based mostly on the present request and latest trajectory (that’s, occasions inside a session). They don’t remodel requests, name instruments, carry out evaluation, or straight orchestrate the agent.

Temporal insurance policies function on the visitors that flows via AgentCore Gateway. As a result of Gateway routes an agent’s Mannequin Context Protocol (MCP) instrument calls, agent-to-agent calls, and mannequin inference calls via a single endpoint, a temporal coverage can govern all three each time your agent points these calls via the gateway. This provides you one constant place to motive about an agent’s conduct over time, no matter which form of name the agent is making.

How temporal insurance policies work

Temporal insurance policies construct on the present coverage engine that’s already used for stateless entry management. They introduce the idea of agent trajectories, that are bounded sequences of actions recognized by a principal and session ID. Brokers by no means see the coverage logic, by no means contact the state retailer, and can’t alter the controls. As with the present AgentCore Coverage options, temporal insurance policies deny by default and forbid wins over allow.

When the gateway receives a instrument name, the coverage engine:

1. Queries the trajectory state for actions, inputs, and outputs related to the insurance policies being evaluated.
2. Evaluates every temporal coverage in opposition to the present request within the context of its historic scope (that’s, prior occasions throughout the customer-defined trajectory).
3. Returns a deterministic ALLOW or DENY choice and logs the complete context of the choice.

Each request {that a} temporal coverage evaluates should carry an x-amzn-bedrock-agentcore-policy-session-id header, which identifies the session the request belongs to. You determine what constitutes the start and finish of a session. The boundary can replicate no matter unit of labor is smart to your software, whether or not that may be a single consumer dialog, a multi-step activity, or a longer-running workflow. As a result of there will be no a couple of concurrent authorization request per session, we suggest protecting the scope of a session as slim as potential. If no header is handed, one might be generated in your behalf. Nonetheless, word {that a} new session ID implies that the coverage engine will consider in opposition to a brand new, empty trajectory with no historical past.

A session isn’t outlined by its ID alone. AgentCore combines the session ID with the top consumer’s id to supply a novel session, which suggests two completely different identities can current the identical session ID and nonetheless be handled as having fully separate periods. Insurance policies apply independently to every trajectory, as a result of the underlying id differs. Inside an lively session, agent trajectories carry a most look-back window of 24 hours. Any trajectory occasions older than which can be routinely deleted. One further rule governs the connection between periods and the insurance policies themselves. Each time a change is made to the insurance policies in a coverage engine, current periods are invalidated. This makes positive that every session is evaluated in opposition to the present set of insurance policies and every related trajectory occasion is recorded with the anticipated schema.

Making use of temporal insurance policies to a personal banking portfolio agent

To make these ideas concrete, we’ll stroll via how temporal insurance policies can safe a hypothetical personal banking agent. The agent helps wealth advisors at a monetary providers agency handle shopper portfolios. It retrieves shopper profiles, masses portfolio holdings, fetches real-time market costs, performs evaluation, and executes trades on the advisor’s behalf.

On this state of affairs, the next MCP instruments are uncovered via the AgentCore Gateway:

There are three completely different advisor roles: junior advisors (restricted commerce authority), senior advisors (full commerce authority), and compliance officers (read-only monitoring entry). On this instance, we are going to use Amazon Cognito for id and go JWTs for inbound auth to the AgentCore Gateway, which hosts our agent’s instruments. To study AgentCore Gateway and easy methods to arrange auth with Gateway, learn the AgentCore Gateway Documentation. Temporal insurance policies use Dogwood, a brand new open-source governance language designed for brokers and their instruments. Dogwood helps evaluating current Cedar policies and allows assist for temporal circumstances. As a result of Dogwood is suitable with current Cedar insurance policies, prospects can proceed to make use of their present Cedar insurance policies without having emigrate. For extra element on Dogwood and its semantics, you’ll be able to learn the language documentation or this weblog submit.

The compliance crew requires the next temporal controls earlier than the agent reaches manufacturing:

1. The agent should pull the shopper profile, then load the portfolio, earlier than any commerce executes.
2. The portfolio_id utilized in a commerce should precisely match the output from get_client_profile.
3. Market costs have to be retrieved inside 1 minute of a commerce execution.
4. No single session can exceed $60,000 in whole commerce worth.
5. Any particular person commerce over $25,000 requires advisor approval, one approval per commerce.
6. The agent can’t purchase after which promote the identical safety throughout the identical trajectory if it sells for a loss.
7. After quarter-hour with out advisor interplay, the agent loses entry to jot down operations.

Request stream via gateway and coverage

This diagram demonstrates how requests to your gateway are intercepted and evaluated by Coverage in AgentCore. When the portfolio agent initiates a instrument name, the next steps happen:

1. The request arrives on the AgentCore Gateway. The advisor is already authenticated via AgentCore Identification. The request carries the trajectory ID for the present session.
2. The coverage engine retrieves the trajectory’s accrued state.
3. Every temporal coverage evaluates the present request in opposition to that historical past.
4. If all insurance policies allow, the request proceeds to the MCP instrument. If any coverage forbids, the request is denied and the denial is logged.
5. On profitable execution, the motion and its outcome are appended to the trajectory state for future evaluations.

Implementing temporal insurance policies

When you’ve got an current coverage engine in ENFORCE mode, you’ll be able to both replace its enforcement mode to LOG_ONLY, or you’ll be able to change the enforcement mode of the person insurance policies. Switching current insurance policies or coverage engines to LOG_ONLY mode will not be advisable for manufacturing workloads since insurance policies will now not implement these safety guidelines.

Stipulations

Earlier than implementing this resolution, confirm that you’ve met the next stipulations:

• An lively AWS account with Amazon Bedrock AgentCore enabled.
• An AgentCore Gateway with no less than one MCP goal configured.
• A coverage engine hooked up to the gateway.
• Acceptable Identification and Entry Administration (IAM) permissions to create and handle coverage sources (see documentation).

Coverage 1: Workflow sequencing (multi-hop chain)

The compliance crew requires that the agent observe get_client_profile, then load_portfolio, then rebalance_portfolio in sequence. With out the shopper profile, the agent has no system-verified context about which portfolios belong to this shopper, what the shopper’s danger tolerance is, or what account restrictions apply.

allow (principal, motion == AgentCore::Motion::"FinTarget___load_portfolio", useful resource == AgentCore::Gateway::<GATEWAY_ARN>)
when temporal {
    previously inside 5m (AgentCore::Motion::"FinTarget___get_client_profile"::response{eventResource: useful resource})
};

allow (principal, motion == AgentCore::Motion::"FinTarget___rebalance_portfolio", useful resource == AgentCore::Gateway::<GATEWAY_ARN>)
when temporal {
    previously inside 5m (AgentCore::Motion::"FinTarget___load_portfolio"::response{eventResource: useful resource})
};

This coverage forbids rebalance_portfolio until get_client_profile and load_portfolio have each accomplished within the appropriate order inside this trajectory. An agent that skips the load profile step and jumps on to rebalancing is denied no matter what directions it obtained.

Coverage 2: Output-to-input integrity

The portfolio_id handed to execute_trade should precisely match one of many portfolio IDs returned by get_client_profile. The agent can’t fabricate or substitute a distinct portfolio ID.

allow (
    principal,
    motion == AgentCore::Motion::"execute_trade",
    useful resource
)
when temporal {
    previously inside 24h (
        AgentCore::Motion::"get_client_profile"::response{
            enter.profile_id: context.enter.profile_id,
            eventResource: useful resource
        }
    )
};

This coverage prevents an attacker from utilizing immediate injection to steer the agent to commerce in opposition to a distinct shopper’s portfolio. The attacker can persuade the LLM to make use of a fabricated ID, however the coverage verifies the worth in opposition to what the CRM system truly returned.

Coverage 3: Knowledge freshness

A get_market_price name should have accomplished throughout the final 30 seconds earlier than execute_trade is allowed. The agent can’t act on stale quotes.

allow (
    principal,
    motion == AgentCore::Motion::"execute_trade",
    useful resource
)
when temporal {
    previously inside 30s (
        AgentCore::Motion::"get_market_price"::response{eventResource: useful resource}
    )
};

In unstable markets, even a 60-second-old quote can characterize vital worth drift. This coverage forces the agent to refresh its market knowledge earlier than each commerce, making certain that selections are based mostly on present data.

Coverage 4: Cumulative price range cap per trajectory

Whole commerce worth in a single coverage session (or trajectory) can’t exceed $60,000. This accommodates blast radius from runaway brokers or profitable assaults.

allow (
    principal,
    motion == AgentCore::Motion::"execute_trade",
    useful resource
)
when temporal {
    exists (whole: Lengthy). ((sum quantity for (quantity: Lengthy), (t: Timepoint). the place (previously inside 24h (
        AgentCore::Motion::"get_market_price"::request{enter.value: quantity, eventResource: useful resource} && tp
    )
};

A compromised agent executing dozens of small trades that individually look wonderful can nonetheless accumulate catastrophic publicity. After $60,000, all trades are denied till a brand new trajectory begins.

Coverage 5: Human approval for big trades (one-time consumption)

Any commerce exceeding $25,000 requires the advisor’s specific approval. Every approval is consumed by a single commerce. A second giant commerce requires a contemporary approval.

allow (
    principal,
    motion == AgentCore::Motion::"execute_trade",
    useful resource
)
when {
    context.enter.value < 25000 || temporal {
        !(
            AgentCore::Motion::"execute_trade"::response{eventResource: useful resource}
        )
        since inside 24h (
            AgentCore::Motion::"approve_trade"::response{ enter.standing: "permitted", eventResource: useful resource}
        )
    }
};

This prevents the agent from deciphering a single approval as blanket permission for a number of giant trades. Every approval covers precisely one execution.

Coverage 6: Mutual exclusion

The agent can’t purchase after which promote the identical safety throughout the identical trajectory if it sells for a loss.

allow (
    principal,
    motion == AgentCore::Motion::"execute_sell",
    useful resource
)
until {
    context.enter.revenue < 0 && temporal {
        previously inside 24h (
            AgentCore::Motion::"execute_buy"{
                stock_symbol: context.enter.stock_symbol, eventResource: useful resource}
        )
    }
}
};

If the agent bought AAPL two minutes in the past and now tries to purchase AAPL, the request is denied. The contradiction itself is the sign that one thing has gone improper and the session needs to be reviewed.

Coverage 7: Progressive belief decay

After quarter-hour with out advisor interplay, the agent loses entry to jot down operations (execute_trade, rebalance_portfolio). The advisor can re-engage at any time to revive full entry.

allow (
    principal,
    motion in [
        AgentCore::Action::"execute_trade",
        AgentCore::Action::"rebalance_portfolio"
    ],
    useful resource == AgentCore::Gateway::"<arn>"
)
until temporal {
    previously inside 15m AgentCore::Motion::"interact_advisor"::response{eventResource: useful resource}
};

If the advisor walks away, the agent naturally converges towards read-only conduct. This ensures that prolonged autonomous operation doesn’t accumulate unchecked danger.

Value issues

You solely pay for the authorization requests carried out throughout agent execution. Every time an agent calls a instrument via AgentCore Gateway, Coverage checks the motion in opposition to your guidelines to find out whether or not it’s allowed or denied. Your first 100 temporal insurance policies per coverage engine are included within the current per-authorization-request worth (see the AgentCore pricing web page for particulars).

Clear up

To keep away from ongoing prices, take away the sources you created on this walkthrough. Delete the sources so as: first delete the temporal insurance policies from the coverage engine, then detach the coverage engine from the gateway, after which delete the coverage engine itself. A coverage engine can’t be deleted whereas it nonetheless accommodates insurance policies or stays hooked up to a gateway. In case you created the gateway, its MCP goal solely for this walkthrough, delete these as properly. Observe that deleting or altering insurance policies invalidates any lively coverage periods, so carry out cleanup solely after your check periods are full.

Record and delete the insurance policies on the coverage engine. Repeat the delete-policy command for every of the seven insurance policies:

aws bedrock-agentcore-control list-policies $
  --policy-engine-id <POLICY_ENGINE_ID>

aws bedrock-agentcore-control delete-policy $
  --policy-engine-id <POLICY_ENGINE_ID> $
  --policy-id <POLICY_ID>

Detach the coverage engine from the gateway by updating the gateway with out a coverage engine configuration:

aws bedrock-agentcore-control create-gateway $
  --name my-gateway $
  --role-arn arn:aws:iam::123456789012:position/my-gateway-service-role $
  --protocol-type MCP $
  --authorizer-type CUSTOM_JWT $
  --authorizer-configuration '{
    "customJWTAuthorizer": {
      "discoveryUrl": "https://cognito-idp.us-west-2.amazonaws.com/some-user-pool/.well-known/openid-configuration",
      "allowedClients": ["clientId"]
    }
  }'

Delete the coverage engine:

aws bedrock-agentcore-control delete-policy-engine $
  --policy-engine-id <POLICY_ENGINE_ID>

(Non-obligatory) Delete the gateway goal and gateway in the event you created them for this walkthrough:

aws bedrock-agentcore-control delete-gateway-target $
  --gateway-identifier <GATEWAY_ID> $
  --target-id <TARGET_ID>

aws bedrock-agentcore-control delete-gateway $
  --gateway-identifier <GATEWAY_ID>

Conclusion

On this submit, you discovered how temporal insurance policies carry stateful, trajectory-aware authorization to agentic AI techniques. You utilized seven coverage patterns to a hypothetical personal banking portfolio agent. These patterns lined workflow sequencing, output-to-input integrity, knowledge freshness, cumulative price range caps, human-in-the-loop approvals, mutual exclusion, and progressive belief decay. These patterns generalize throughout domains the place brokers work together with delicate instruments at runtime. As a result of enforcement occurs on the AgentCore Gateway perimeter, exterior the agent’s personal reasoning loop, these protections stay tamper-proof no matter mannequin conduct. This provides you a declarative, auditable solution to implement operational boundaries with out constraining the flexibleness that makes brokers beneficial. To get began, overview the AgentCore documentation.

Concerning the authors